htaccess problem

[jimberger]

hi all,

I am trying to secure a part of my web server. I have a directory called /confidential. I want anyone with a valid password to get access to this directory. I have a location tag in apache which validates against a valid user. However, i have other directories within this directory that i only want to limit to certain people. I am using .htaccess files for this purpose. I have a directory tag on the /confidential directory which has the allow overides directive on. This should allow .htaccess to overide. However, what happens is that people are validated when they enter the /confidential directory - which is good - however if they go on to access a sub-directory when they are not named in the .htaccess file - they still have access! Does anyone understand whats going on here?

thanks for your time

jim

 

[ifincham]

Hi,

Apache will look for .htaccess files in the specific sub-directory and all parent directories up to /. It works in such a way that the lower down the directory tree the files are the more they override higher equivalent entries. So, if you don't have a .htaccess file in a sub-directory it will 'inherit' the rules from the parent directory or directories. Not too sure from what you say but this might be the problem.

Regards

 

[jimberger]

thanks for the reposnse ian. I think you have a understanding of apache but dont quiet understand my problem. In theory, my web server should authenticate against the .htaccess files in the sub directorys but it dosent it authenticates against the location tag which is on the parent directory.

 

[ifincham]

Hi,

Hmmm - well the location tag references a url and not necessarily a directory. A bit of digging reveals that the order of evaluation is such that Location and LocationMatch are done last which means that those directives override directives in all other containers insofar as a URL is concerned. Also, if a directive in a <Location> container directly conflicts with the same directive in either a <Directory> (.htaccess) or <Files> container , the directive in the <Location> container will override the others.

See -->

http://httpd.apache.org/docs/sections.html

.

Regards