Is there a way to get apache to send a 403 instead of a 401 with some config in an .htaccess file? I'm using dreamhost btw.


I should better explain what I am doing. I am doing an HTTP auth login page with jQuery. My goal is to bypass that browser popup login window. To do this, I want the server to give me a 403 error when I try to access a file in the protected realm, as opposed to the 401 I am currently getting by default. When I get that 403, I can run a function that tells the user they have a password wrong instead of that browser popup, which doesn't tell the user they got information wrong, it just makes the site look bad in the end.

thanks =)


You can use a rewrite rule to produce a 403.

RewriteEngine on
RewriteRule myfile myfile [F]

F, in this case, means forbidden (403).

...and yes, this goes in the .htaccess file.

As described in a comment to radius answer, you'd like to check if a user is authorized. I don't know how you're doing your authorization, but my guess is that it's not immediately possible. I usually do my authorization in PHP, in which case you can simply do a header('HTTP/1.1 403 Forbidden');, but you seem to be using some other mechanism (apache internal I suppose).

  • Yeah I actually am doing auth in apache. But I guess if I could try a PHP based one, and maybe it could send the auth to apache? It's worth a shot. – Kyle Jul 21 '09 at 18:13
  • peej.co.uk/articles/http-auth-with-html-forms.html seems to do what I want. It doesn't supply that www-authenticate header, which seems to be making the popup come up. – Kyle Jul 21 '09 at 18:16

chmod the file so that it is not readable.

  • is there a way to get the 403 before the 401 though? I am doing a login thing with jquery, and if all the protected files returned 403 then that stupid browser window wouldn't popup. thanks btw! – Kyle Jul 21 '09 at 17:36

Give us more information about what you are doing.
If you have a protected ressource using authentification apache will return code 401. If it returns 403 instead of 401 your browser will not ask you for a password.
If the ressource is not protected by authentification you should not get an error 401.

Edit: As per your edit, I understand that you want http://website/files/forbar to return 403, and have a 403 error page asking for a password (let say http://website/403.php).
I don't think you can do that because your script will not be able to tell apache that the file is no longer forbidden when the user will be logged in.
So you could have the file returning 403 but it will never return something else.

The way I would do is to have 'file' outsite of you public web directory and users to load http://website/myscript.php?getfile=foobar, so that your script can control if user is authenticated or not and give the file when the user will be authenticated.
Of couse you can then add an apache redirection to tell http://website/file/"something" to redirect to http://website/myscript.php?getfile="something" (this one would be RedirectMatch /file/(.*) http://website/myscript.php?getfile=$1

  • actually, 401 (Unautorized) will cause it to ask for password. – falstro Jul 21 '09 at 17:40
  • Right, sorry I inverted 403 and 401. Now Corrected. – radius Jul 21 '09 at 17:59
  • I'm trying to do HTTP auth in jQuery. I am going to do this by checking if a user is already logged in ( get a file in the protected realm, if it returns a 403, it could run a function that tells the user they were wrong as opposed to that window popping up) – Kyle Jul 21 '09 at 17:59
  • Ooooooooh! @Kyle, update your question, I don't think anyone got that. – falstro Jul 21 '09 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.