1

I am using apache's basic http authentication to control access, however, I only want to control one level of directory access, meaning, I only want directory a to be authenticated, but not a's children(eg. a/b), is this possible?

<Location /a/>
Options -Indexes
Order Deny,Allow
Allow from all

AuthType Basic
AuthName "Members Only"
AuthUserFile /home/xxxx/.htpasswd
require valid-user

</Location>
0

2 Answers 2

2

AFAIK this is not possible. I have just tried it in both httpd.conf and a .htaccess file, and it doesn't work.

This is because in general, this setup makes no sense - the point of requiring auth for a directory is to protect an area of your site, and subdirectories of the protected directory would be considered part of that protected area.

The scope of HTTP Basic auth is per-domain - if you require auth for a subdirectory, those same credentials will be sent in a subsequent request to a higher level directory. This means they will also be sent in all requests for a lower level directory.

It would be possible to implement this using some custom logic in your server-side scripting (e.g. PHP) but a better solution would be to re-think your directory structure. There should be no reason to require authentication for a higher level directory, but not lower level ones - you need to move the content in your lower-level directories to an open access area of the site, and the password protected area should only contain content that should be private.

As a side note - HTTP Basic authentication over HTTP is so insecure it is almost pointless to use it at all - if you have some content you really care about protecting, consider using Digest auth. You can use HTTPS to prevent disclosure of Basic authentication credentials, and if you're using HTTPS you could also use client certificate authentication for the best available security.

2
  • Just a guess but not even by moving the unauthenticated directories elsewhere and referencing them via mod_rewrite?
    – symcbean
    Sep 6, 2011 at 14:51
  • No, I'm afraid not. What exactly are you trying to do/why do you need to do this? As I say, it's not really something you should ever do/need to do, and there is probably a better way...
    – DaveRandom
    Sep 6, 2011 at 15:05
1

Note that I have not tried this, and I am not an apache guru, but assuming DaveRandom is right, my next attempt would be to use a .htaccess file in directory /A/, then use URL rewriting to point things to /A/child, with the logic that /A/child would never cause a directory traversal to /A/ to read the .htaccess file, since the directory interpretation occurs later in the process.

Of course, if that works, it's probably a bug and will be fixed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .