.htaccess Tools

Welcome to Htaccess Tools forums

Try one of our .htaccess generator tools:

Members

Help

Home

Today's Messages (ON) | Unanswered Messages (OFF)

Forum: Htaccess Questions

Topic: redirected to /401.shmtl with .htpasswd & SSL force higher up

redirected to /401.shmtl with .htpasswd & SSL force higher up [message #961]

Thu, 28 August 2008 01:09

rupertrealbear
Messages: 1
Registered: August 2008
Location: Hertfordshire, England

Hi

I set up a .htpasswd file in the root of my account on a VPS and put a .htaccess in a sub folder /public-html/hq containing a directives to password protect this folder:-

AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile /home/charlie/.htpasswd 
AuthGroupFile /dev/null 
require valid-user

When there is also a .htaccess higher up, in the /public-html folder forcing SSL on all requests (always on, throughout the site):-

 . . .

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

. . . I generally get directed to some default (and non-existent) error document "/401.shmtl".
When in a page in the sub folder /public-html/hq, [which happens to post to itself] I do get the password popup - and also if I revisit a cached call to a https:// URL in that folder.

The situation was un-liveable, though I have moved the 'force SSL' directives into the .htacess in /public-html/hq:-

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile /home/charlie/.htpasswd 
AuthGroupFile /dev/null 
require valid-user

This actually asks for the password TWICE (before and after conversion of the request into htpps://)
I suppose I could bare having to subject the user to this.
I just wondered if there was some workaround - like having the .htpasswd only apply to https ? (or maybe some other subtle solution ?)

Suggestions would be much appreciated

Many thanks

Guy Hackney

Report message to a moderator

Current Time: Thu Aug 28 02:56:07 CEST 2008