.htaccess Guide: Password protection: Edit Article - by Locked-Area.com (HTACCESS tutorial, examples, articles, password protection, 404 error documents, allow deny, DirectoryIndex uses, Adding MIME types, Enabling SSI with .htaccess, Enabling CGI outside of the cgi-bin, Prevent viewing of directory listings, Redirects, Deny visitors by IP address, Deny visitors by referrer, Hot link prevention techniques, Blocking offline browsers and 'bad bots')

.htaccess Guide: Password protection: Edit Article

This tool enables you to update articles on our web site. Whether you wish to advance the article further or simply correct a spelling mistake your input is welcomed! Your updates will not be published immediately, all submissions are reviewed before being published to prevent abuse.

The password protection and authentication systems offered by the Apache Web Server are probably the most important use of .htaccess files.  Very easily, we can password protect a directory (or multiple) of a web site which require a username and password to access.  The login procedure for these secure directories is handled automatically by the web browser using a pop-up login interface (you've probably seen these before).  Passwords are also encrypted using one of the best encryption methods available which ensures login credentials are kept secure.  In this section we will discuss the details of the .htaccess authentication system, we will explain how to set-up password protection, and a variety of helpful related information, we will also explain a variety of pre-made software which can be used to accomplish these tasks.
<p>
The pop-up login interface varies between web browsers, here are two examples, one from 'Microsoft Internet Explorer' and the other from 'Mozilla Firefox'.
<p>
It is not possible to offer a log-out facility, the login details are cached in the web browser until the browser is closed, so visitors may leave the web site and return later in the session without being prompted to login again.  When the browser is closed and re-opened the login details are deleted from the cache and the pop-up prompt will be displayed.  The log-out facility has been discussed for some time, details of the various suggestions can be found in the advanced section of this article.
<p>
To begin, decide which directory you would like to password protect (note that all files and subdirectories within the directory will be password protected), then create a .htaccess file following the main instructions and guidance which includes the following text:
<p>
<center><table width="90%" cellpadding="1" cellspacing="0" border="0" bgcolor="#cccccc"><tr><td>
<table width="100%" cellpadding="10" cellspacing="0" border="0" bgcolor="#ffffff"><tr><td><font face="Arial" size="2"><span class="gen"><i>
AuthName "Member's Area Name"<br>
AuthUserFile /path/to/password/file/.htpasswd<br>
AuthType Basic<br>
require valid-user
</i></span></font></td></tr></table></td></tr></table></center>
<p>
The first line tells the Apache Web Server the secure directory is called 'Member's Area Name', this will be displayed when the pop-up login prompt appears.  The second line specifies the location of the password file.  The third line specifies the authentication type, in this example we are using 'Basic' because we are using basic HTTP authentication and finally the fourth line specifies that we require valid login credentials, this line can also be used to specify a specific username, e.g. 'require user username' would require the username 'username'.  You would use this if you were password protecting an administration area, rather than setting up a public password protected directory.
<p>
The location of the password file can be anywhere on your web server, the '/location/of/password/file/' must be replaced with the full/absolute path to the directory containing the password file, and the '.htpasswd' file must exist, this can however be called anything.  We use the filename '.htpasswd' because the server will recognise the filename and will hide it from visitors.  Note, some servers do require the password file be located in the same directory as the .htaccess file.  It is also important to use a full/absolute server path for the location of the password file, a relative path, or any variation of a URL will not work.
<p>
The password file would contain something similar to the following text:
<p>
<center><table width="90%" cellpadding="1" cellspacing="0" border="0" bgcolor="#cccccc"><tr><td>
<table width="100%" cellpadding="10" cellspacing="0" border="0" bgcolor="#ffffff"><tr><td><font face="Arial" size="2"><span class="gen"><i>
username:encryptedpassword<br>
fred_smith:oCF9Pam/MXJg2
</i></span></font></td></tr></table></td></tr></table></center>
<p>
Now, you cannot just make up the password, they must be encrypted by the server, you can have any number of records in this file, one account per row, separating the username and password with a colon.  Locked-Area.com offers a product called 'DirectoryPass' which is very useful for this task.  DirectoryPass is a very simple Perl script which automates the process of setting up password protection, and more importantly creating the user accounts.
<p>
Setting up a password protected directory allows you to offer a member's area, offering a member's area on your web site is also a great way of tracking your web site visitors and a brilliant way of building a community feel on the web site.  By asking visitors to register to access the content you are able to collect whatever information about the visitors that you require, whether it be the visitors country of residence, sex or professional status.
<p>
Such a system can be setup very easily these days thanks to the vast array of pre-made solutions available on the Internet, most of which are as easy to setup as the initial web site content.  Locked-Area.com offers two other solutions to this scenario which have proven very popular, one is called 'Locked Area' which has been available on the Internet for over seven years and is now in use on over fifty thousand web sites.  This a very simple but effective member's area management system which is available completely free of charge, it can be used to set-up a secure member's area to store your content, it includes a registration system for your web site visitors to register for member's area access, and it includes a fantastic administration panel to help you manage accounts and email your members.  Another product we offer is, 'OpenCrypt'.  'OpenCrypt' is Locked-Area.com's enterprise solution for membership management and offers some impressive facilities including an extensive statistical analysis system and possibly the most flexible registration system seen in this market.  Both products also ensure the security of your content and ensure that visitors cannot access the member's area without registering, 'OpenCrypt' also offers comprehensive  facilities to prevent your visitors from sharing their login details which is especially important with high-demand web sites.  A variety of other solutions are available to accomplish this task, my advice would be to use a piece of software written in preferably Perl, or alternatively PHP.  In my experience I would not recommend the use of software written in ASP or ColdFusion particularly when looking for security related software.  I have listed a number of web sites which you will find useful when looking for similar solutions, namely <a href="http://www.hotscripts.com/CGI_and_Perl/Scripts_and_Programs/User_Management/" target="new">Hot Scripts</a>, <a href="http://cgi.resourceindex.com/Programs_and_Scripts/Perl/Password_Protection/" target="new">CGI Resources</a> and <a href="http://www.cgi-index.com/Perl/Password_Protection_and_Security_Systems/" target="new">The CGI-Index.com</a>.

Please do not apply any styles to the article, changes in font, color, width and so on are not necessary.