Configuring Apache to look for configuration files (.htpasswd) in DocumentRoot not in ServerRoot

Question

I'm looking for a way to force Apache to look for files relatively to DocumentRoot not to ServerRoot. Now if I create .htaccess as follows:

#Protect Directory
AuthName "Please provide valid username and password"
AuthType Basic
AuthUserFile .htpasswd
Require valid-user

Apache looks for the .htpasswd in:

/opt/homebrew/opt/httpd/.htpasswd

and I would like to look for it in:

/opt/homebrew/var/www/FOLDER/.htpasswd

.htaccess is placed in:

/opt/homebrew/var/www/FOLDER/.htaccess

I don't want to change ServerRoot and move all the configuration.

You _are_ aware of the warning in the documentation? "Web password files such as those managed by htpasswd should not be within the Web server's URI space" ... — arkascha, Aug 07 '23 at 18:58
Apart from that I am confused by your question. The documentation clearly demonstrates that you should specify an _absolute_ path within the server side file system. So the rest of the configuration should be irrelevant. The exact location of that file does not matter. It certainly should _not_ be within the part of the file system where web content is stored, for obvious security reasons. Apart from it you are free to chose, as long as the http server process is able to reach and read that file. — arkascha, Aug 07 '23 at 19:00

MrWhite · Answer 1 · 2023-08-07T19:53:35.313

You cannot change this behaviour. As per the Apache docs for the AuthUserFile directive, the file-path given to the AuthUserFile directive must be either:

An absolute filesystem path. For example:

AuthUserFile /opt/homebrew/var/www/FOLDER/.htpasswd

OR,

A file-path relative to the ServerRoot.

However, assigning a path relative to the document root would also go against security recommendations, that specifically states:

Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.

In your example (AuthUserFile .htpasswd) it looks like you are wanting this to be relative to the directory that contains the .htaccess file, not just the document root?

If you need to serve different configs on different servers then you can use <If> expressions (or other conditionals) to set AuthUserFile conditionally based on elements of the request or server.

You could also use defined variables. For example:

# In the server config
Define DOCUMENT_ROOT /opt/homebrew/var/www

In .htaccess:

:
AuthUserFile ${DOCUMENT_ROOT}/FOLDER/.htpasswd

Configuring Apache to look for configuration files (.htpasswd) in DocumentRoot not in ServerRoot

1 Answers1