.htaccess authentication only seems to promt once

[keak]

Hi there.
I have a htaccess file with the following entry:

AuthName "Members Only"
AuthType Basic
AuthUserFile /[URL unfurl="true"]www/www.site.com/.htpasswd[/URL]
AuthGroupFile /dev/null
require valid-user
Options -Indexes

and when I access this website, I get a prompt for user/pass.
When I type the correct entry, it directs me to the index.php file correctly.

However, if I type in a wrong pw, it doesn't prompt me again, and goes to a blank error page instead.
Am I missing any apache config here?

Many thanks in advance!

 

[sleipnir214]

The behavior, I think, is browser-specific.

I have an Apache 2.2 system with a directory protected with the statements:

AuthType Basic
AuthName "Restricted Resource"
AuthUserFile /path/to//htpasswd_file
Require valid-user

I tested using a wrong login to the directory using IE, Opera and Firefox. Opera and Firefox will keep asking for the wrong password as many times as you like (I only liked trying 5 times with each). IE asks three times only, then shows you the login error page.

What browser are you using?




Want to ask the best questions? Read Eric S. Raymond's essay "How To Ask Questions The Smart Way". TANSTAAFL!

 

[keak]

I am using IE.
If I use firefox and type in a wrong password, it prompts to download the index.php file instead of going to a error page.

The does seem to be some configuration issue here in my apache ...

Also, its strange that it only prompts me once in IE instead of the default 3 times and usually after 3 wrong attempts it should forward you to a 303 authentication err page instead of a blank page I believe.

 

[sleipnir214]

I am using IE.

I'm using 7.0.57something. If your version is different, you can expect very different behavior. Microsoft is notorious for drastically changing the behavior of IE from version to version.

download the index.php file instead of going to a error page.

And if you agree that FireFox should download the file, what do you get?

it should forward you to a 303 authentication err page instead of a blank page I believe.

Again, all this behavior is likely browser-driven, not server driven. Since HTTP is stateless, the server will have no way to know that three successive connections are from the same browser. Unless the browser provides an "Authorization:" header, the server is just going to keep returning a "401 Authorization Required" HTTP response.

IE is also notorious for replacing server error pages with its own.






Want to ask the best questions? Read Eric S. Raymond's essay "How To Ask Questions The Smart Way". TANSTAAFL!