.htaccess problem 1

[Guest_imported]

I've set up password protection on a directory of my site using .htaccess.

The password protection seems to be working ok. Users are propted to enter username/password upon requesting the directory. Everything is fine there.

The problem is, users are asked again and again to authenticate when using the links on the site. I have no idea why.

For context, the index page in the directory is a simple .html page with links to downloadable .pdf and .xls files in a subdirectory.

Any advice would be greatly appreciated.

Thanks.

 

[Wullie]

Hi mate,

At first glance, I have no idea..

Can you post the contents of your htaccess here and also any relevant pieces of your httpd.conf?

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[Guest_imported]

Thanks for the fast reply.

The contents of my .htaccess are below, with SITENAME/DIRECTORY and USERNAME substituted.

AuthUserFile /export/nfs/cust/6/0/1/SITENAME/DIRECTORY/.htpasswd
AuthGroupFile /dev/null
AuthName Authentication
AuthType Basic

<Limit GET>
require user USERNAME
</Limit>

As for my httpd.conf, I do not have access to my hosting provider's shell. So I can't get at that file, right?

Is that potentially the problem?

Thanks again.

 

[Wullie]

Hi mate,

This is just a suggestion and may or may not work..

Try using the following:

AuthUserFile /export/nfs/cust/6/0/1/SITENAME/DIRECTORY/.htpasswd
AuthGroupFile /dev/null
AuthName &quot;Authentication&quot;
AuthType Basic

<Limit GET>
require user USERNAME
</Limit>
Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[Wullie]

And as for the httpd.conf, I can't really see that being a problem as you are actually getting the prompt and also logging in..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[iTST]

We've had a similar issue and solved it this way.

The page with the dowload links is proteced as you did it.
The directory where the download files reside is proteced with a &quot;SetEnvIfNoCase Referer .\our-domain\.com&quot; statement (please look up in the Apache doc for fruther information:

http://httpd.apache.org/docs-2.0/mod/mod_setenvif.html

).
This allows access to the files only for user agents with a valid referer from your domain. Maybe you could also write something like &quot;\.our-domain\.com/proteced-download-page.htm&quot;

HTH, Sascha cu, Sascha

http://www.itst.org/

 

[Guest_imported]

Wullie,

Unfortunately, this did not solve the problem. I attempted it, but the multiple prompts persist.

Thanks for your help.

 

[Guest_imported]

Accoding to clever.net...

The .htaccess file affects the directory in which it is placed, so any visitor requesting <URL:

http://somewhere.com/somepath/>

would be presented with an authentication request.

The .htaccess file also affects directories recursively below it. Therefore, requesting <URL:

http://somewhere.com/somepath/evenmore/>

would yeild the same authentication request unless ~/somepath/evenmore had a .htaccess file of its own.

As a novice, I'm now struggling with what the .htaccess in the subdirectory should include so as not to prompt the user for aurthentication.

 

[iTST]

Try this one for the subdirectorys.

Order deny,allow
Allow from localhost

If it fails, try this

Order allow,deny
Allow from all

HTH cu, Sascha

http://www.itst.org/

 

[Wullie]

Hi mate,

htaccess must not be placed in a subdirectory of a protected area unless you require different login details for that subdirectory..

When you place a htaccess file in a directory, all subdirectories are automatically protected..

Just include a htaccess in the highest directory that you want to protect only..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[iTST]

I unterstood connoroo wanted to protect only the top level directory. cu, Sascha

http://www.itst.org/