2

I created a password protected directory using .htaccess and .htpasswd, but the files don't show up when I go to the directory URL.

I have this in my .htaccess:

#Protect multiple files
<FilesMatch "^(.*).csv$">
AuthName "Dialog prompt"                                                                                                                                                                                       
AuthType Basic
AuthUserFile /xxxxx/test                                                                                                                                              
#AuthUserFile ".htpasswd"                                                                                                                                                                                      
Require valid-user                                                                                                                                                                                             
</FilesMatch>       

Directory listing - not showing the CSV files

UPDATE: I'm protecting the CSV files in that directory. They disappear from the directory listing when that auth directive is set. They show up when I remove it. I want to be able to at least see the files in the directory listing, but when accessing these files it would offer an auth prompt.

3
  • 1
    Does this answer your question? how to configure apache to view hidden (`.`) files? – djdomi Jun 16 at 14:14
  • "when I goto the URL" - What URL? You have your mod_auth... directives in a <FilesMatch "^(.*).csv$"> container, but from your screenshot you would seem to be requesting a directory? Please explain exactly what you are trying to protect, what request(s) you are making and what the expected outcome is? – MrWhite Jun 16 at 14:28
  • 1
    I'm protecting the CSV files in that directory. They disappear when that auth directive is set. It shows up when I remove it. I want to be able to at least see the files, but when accessing these files it would offer a auth prompt. – Patoshi パトシ Jun 16 at 14:39
1

I'm protecting the CSV files in that directory. They disappear when that auth directive is set. It shows up when I remove it. I want to be able to at least see the files, but when accessing these files it would offer a auth prompt.

When a directory listing is generated using mod_autoindex, an internal subrequest is issued for each file that appears in the directory listing. When using a <FilesMatch "^(.*).csv$"> container then it is also being processed for these subrequests and consequently the entry of these files in the directory listing is also blocked.

An alternative to using the <FilesMatch> directive is to use an <If> expression and test against THE_REQUEST server variable instead. This is then only successful when the .csv files are actually requested by the user and not when browsing the directory listing.

For example:

# Directory listings (mod_autoindex) need to be enabled
Options +Indexes

# Protect CSV files from being accessed, but still visible in directory listing
<If "%{THE_REQUEST} =~ m#\.csv(\s|\?)#">
AuthName "Dialog prompt"                                                                                                                                                                                       
AuthType Basic
AuthUserFile /xxxxx/test                                                                                                                                              
Require valid-user                                                                                                                                                                                             
</If>

THE_REQUEST contains the first line of the HTTP request. eg. GET /foo/test.csv HTTP/1.1 (in the case of a GET request for /foo/test.csv) - and does not change throughout the request. So when requesting the directory itself, eg. /foo/ then the enclosed block is not processed and the listing of these files are not blocked.

The added complication is that THE_REQUEST contains the entire URL as requested, which could include a query string. So, the check for (\s|\?) (ie. whitespace or a literal ?) is to avoid the password check being bypassed by simply including a query string. eg. /foo/test.csv?anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.