CODEWITHSUNDEEP
.htaccesscakephpauthorizationcakephp-2.0
emersonthis
emersonthis

Reputation: 33378

CakePHP: How to allow password access to one directory with .htaccess

In my CakePHP app, I have a directory of files which I want to allow direct access to with a username/password. For reasons that are overly complicated, placing the directory inside the /webroot folder is not an option. My folder is located here:

/app/parent_folder/folder_full_of_files

So I want to be able to access files directly like this:

http://mysite.com/app/parent_folder/folder_full_of_files/some_file.pdf

I think I need to modify the .htaccess file in the root, and also add another .htaccess file and .htpasswd file in the folder_full_of_files

I have already found this post which asks a similar question... but I can't translate it to my application.

  1. How do I need to modify the root .htaccess file?

  2. What should be in the new .htaccess file. Here's what I've tried, but just results in 500 error...

     AuthType Basic
 AuthName "restricted area"
 AuthUserFile /bla/bla/mysite/app/parent_folder/folder_full_of_files/.htpasswd
 require valid-user

  3. What is the correct way to encrypt the password in the .htaccess file?

Upvotes: 1

Views: 1126

Answers (2)

emersonthis
emersonthis

Reputation: 33378

I got this to work. I had to do a couple things...

  1. I added this to the .htaccess file in root:

    RewriteCond %{REQUEST_URI} !^/app/parent_folder/folder_full_of_files

    As @Jon pointed out, my original version above had a mistake ([L]).

  2. I also have an .htaccess file in my /app directory. This might be a quirk about my installation because it is not 100% standard. I can't remember if it's there by default, so I'm mentioning it just in case. IF you don't have one in /app skip this step.

  3. I added this to an .htaccess file in the /folder_full_of_files:

    AuthType Basic
AuthName "restricted area"
AuthUserFile /bla/bla/mysite/.htpasswd
require valid-user

    Make sure the path after AuthUserFile is a fully-qualified path to the .htpasswd file (see next step).

  4. Create the actual .htpasswd file. It's not supposed to be under the document root, but mine is. I think the most important thing is that it's not inside /webroot. I used this command from the terminal and it created the file: 

    htpasswd -c /path/where/it/should/go/.htpasswd whatever_username

    It asks for a plain text password which gets encrypted and written into the file.

That's it. One annoying "gotcha" is that the path in the .htaccess to the auth file must be absolute, which means it will probably have to be edited when moving between local testing and production (unless the two environments are exactly the same). It would be less clunky if relative paths were allowed.

Upvotes: 1

Jon Lin
Jon Lin

Reputation: 143916

  1. You don't need to modify the htaccess file in your document root at all
  2. Make sure you have AllowOverride AuthConfig or AllowOverride All configured for your /app/parent_folder/folder_full_of_files/ directory. Make sure that the directory also has a properly generated htpasswd file (named .htpasswd). You need to use the htpasswd program to generate it, or any number of online generators.

Upvotes: 0

Related Questions