Do not override htpasswd in domain

Question

I have a domain (also folder structure) *.dev.xxx. I need to make a htpasswd that will require credentials on every site on that domain.

My .htaccess

AuthType Basic
AuthName "test"
AuthUserFile /var/www/dev/.htpasswd
Require valid-user

But when the subdomain has its own htaccess it overrides this one and it works without authorization.

Is there a way to force it to authorize?

Thank you for answers.

bin, boot, build, etc, home, lib, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var — tttpapi, Aug 08 '14 at 09:35

score 1 · Answer 1 · answered Aug 08 '14 at 09:38

1

Your structure might looks like this.

/.
/..
/sub
/web
/log

Simply put your .htaccess in the parent folder of sub and web.

answered Aug 08 '14 at 09:38

m1k1o

2,344
16
27

score 1 · Accepted Answer · answered Sep 23 '14 at 23:06

Single-Login cross-subDomain

Browsers will treat different sub-domains as completely different authentication scopes. This is done for security reasons, to prevent password phishing via IP/domain spoofing. Thus it is not possible to do this via .htaccess, except as M1K1O stated earlier:

Simply put your .htaccess in the parent folder of sub and web.

...then prevent and exclude any .htaccess auth declarations in the subfolders.

However, if you are very careful about it, there may be a server-side method of handling it in apache hosts.

Use mod_auth_digest

<VirtualHost [your-ip]:80>
    ServerAdmin webmaster@domain.com
    DocumentRoot /var/www/dev/
    ServerName www.dev.domain.com
    ServerAlias *.dev.domain.com
    ...
    # Add to any your virtual host entries:
    <Location /var/www/dev>
        AuthName "test"
        AuthType Digest
        AuthDigestAlgorithm MD5
        AuthDigestDomain / http://www.dev.domain.com/ http://other.dev.domain.com/
        AuthDigestQop auth
        AuthDigestProvider file
        AuthUserFile /var/www/dev/.htpasswd
    </Location>
</VirtualHost>

One major drawback to this method is that AuthDigestDomain does not support any wildcards. i.e.: every expected subdomain must be explicitly declared, rather than using http://*.dev.domain.com/

Use mod_session to write your own auth handler.

This route is one I've considered in the past, but have yet to delve into due to the long list of security implications.

Do not override htpasswd in domain

2 Answers2

Single-Login cross-subDomain

Use mod_auth_digest

Use mod_session to write your own auth handler.