2

I have this project where I have a front and back. My login file is simple if the login and password are in my database then I'm directed to a page in the back, otherwise I can't go.
I login into the backoffice without a problem but I wanted to protect the back and directories.

I'm trying to lock my backoffice with .htaccess which worked I can't access the backoffice directories but I also can't login anymore.

Here are my two files.

Content of .htaccess:

Deny from all 
Options -Indexes


AuthType Basic
AuthName "KW"
AuthUserFile /.htpasswd
Require valid-user

Content of .passwd:

root:passwordhere

2 Answers 2

1
AuthUserFile /.htpasswd

In addition to the "typo" as mentioned in @Glorfindel's answer (.htpasswd vs .passwd), the argument passed to the AuthUserFile directive should be an absolute filesystem-path, not a document-root relative URL-path, as you appear to be using here.

See my answer to a related question on ServerFault for an example. See also my answer to a similar question on StackOverflow that goes into more detail.

Errors with HTTP authentication are very often caused by using an incorrect file-path to the password file.

However, you also need to remove the Apache 2.2 Deny from all directive on the first line. By default, on Apache 2.4, this will override the Require directive and block all access with a 403 Forbidden - the prompt for a password is suppressed.

0

I'm not sure if this is a typo in your post or in your system, but

AuthUserFile /.htpasswd

points to a file named .htpasswd and your post mentions .passwd.

1
  • Also, the file-path provided to the AuthUserFile directive "looks wrong" - this should be an absolute file-path. The Deny from all directive is also erroneous, as mentioned in my answer.
    – MrWhite
    Jul 7, 2021 at 16:17

You must log in to answer this question.