I have an Apache server with password-protected web directory. That directory has a sub-directory, which requires another password, but anyone who can access the sub-directory should have access to the parent directory as well. That is:
- /stuff - users "stuff" and "admin" allowed
- /stuff/admin - only user "admin" allowed
So I've set it up that way in the Apache config:
<Directory "/stuff"> [AuthType Basic, AuthName, etc.] Require user stuff Require user admin </Directory> <Directory "/stuff/admin"> [AuthType Basic, AuthName, etc.] Require user admin </Directory>
This works in the sense that I can browse to /stuff and log in as either "admin" or "stuff". However, the pages in /stuff/admin references some images from the parent directory. I find that when I browse directly to /stuff/admin and log in as "admin" the browser still prompts me for another password to load those images. (I know it's the prompt for /stuff, because the AuthName value is different.)
How do I avoid this and allow a user who has access to /stuff/admin to just log in once (as "admin"), not twice?