Basic Auth User Management

Question

I have 2 questions regarding Apache Basic Auth that i currently am utilising. I have a website that after a certain action, the website will produce a Basic Auth username and password for the user to use to access a service.

This is working OK at the moment - but the website is picking up traffic rapidly so there are many many entries in the basic auth file now.

Question 1) Is there a limit on the amount of basic auth users apache can handle?

Question 2) is there a better way to manage basic auth users? Or some type of username/password access

Thanks

Answer 1

Is there a limit on the amount of basic auth users apache can handle?

No, You can have as much values as you want inside .htpasswd but with time your server performance will suffer due to high disk I/O reads.

is there a better way to manage basic auth users?

Yes, use a mysql db to store the user/pass and access it with mod_authn_dbd.
Alternatively, you can use php to "emulate" HTTP authentication and query a db with the login info i.e.:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="My Realm"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'Text to send if user hits Cancel button';
    exit;
} else {
    //place the query logic here
    echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";
    echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>";
}
?>