User Authentication with htaccess

Web-based authentication denies web access to visitors who do not give a valid username and password. This feature allows webmasters to restrict access to certain directories. The usernames and encrypted passwords are maintained by the webmaster and can be edited from the command line, or, via a cgi script.

Example

Assuming we want to protect the directory, public_html/admin/

1. SSH to your site and create a file called .htaccess within the public_html/admin/ directory. The contents of this file should be:
   

   AuthUserFile /home/myusername/public_html/admin/.htpasswd
   AuthGroupFile /dev/null
   AuthName "Welcome to MyDomain.com"
   AuthType Basic
   
   require valid-user

2. change directories into public_html/admin and run
   htpasswd -c .htpasswd username
   to create the file and add "username" as the first user. The program will prompt you for a password, then verify by asking again. You will not see the password when entering it here. To add more users, use the same command without the -c switch: htpasswd .htpasswd jane will add username "jane" to your .htpasswd file. To delete users, open the .htpasswd file and delete the appropriate lines.

The .htaccess file affects the directory in which it is placed, so in this example, any visitor requesting http://mydoamin.com/admin/ would be presented with an authentication request.

The .htaccess file also affects directories recursively below it. Therefore, requesting http://mydoamin.com/admin/somepath/ would yeild the same authentication request unless /home/myusername/public_html/cgi-bin/admin/somepath had a .htaccess file of its own.

The first line, starting with AuthUserFile, tells the webserver where to find your username/password file, and, identifies its file name.

The AuthName in the example, "Welcome to MyDomain.com" is presented to the visitor and used in the authentication request.

Related Pages

Printer Friendly Version