Setup htpasswd on directory but allow access to index file

benr77 · 04-18-2007, 06:06 PM

Hello there,

I need to setup htpasswd protection on a web directory served by Apache.

I also need to permit access to the index file in the specified directory, but block access to any other files or subdirectories.

So I'm using a configuration like this:

Code:

<Files index.php>
  Order deny,allow
  Allow from all
</Files>

<Directory "/home/username/www">
  AuthType Basic
  AuthName "Private Area"
  AuthUserFile /home/username/.htpasswds
  require user bill ben
</Directory>

Can anybody tell me why my override of the password protection for index.php files is being ignored?

Or alternatively tell me a better approach to password an entire web site except for the root level index file.

Any input appreciated.

Cheers

Ben

djjoshuad · 04-18-2007, 10:27 PM

I think the standard approach to doing this is to put all password-protected stuff into password-protected directories. I might be missing something here... but is there a reason that the index file you're talking about needs to be publicly accessible while remaining in a password-protected directory? Couldn't you just have:

/index.php
/restricted/everythingelse.php

?

benr77 · 04-19-2007, 01:03 AM

It's an existing application that I can't change the directory structure of, so yes you are right but in this case I can't do that...

benr77 · 04-19-2007, 05:35 PM

I've just found out that the answer to this problem is to add "Satisfy any" into the <Files> directive.

Hope this helps other people who may find this thread...