Protected Directories Access Control Bypassed When Using Proxy

[KrisKnez]

Description

When enabling "Protected Directories," an .htaccess file is automatically created in the specified directory. The file typically contains the following rules:

AuthUserFile "/home/krisknez/domains/app.example.com/public_html/.htpasswd"
AuthType Basic
AuthName "Entire website"
require valid-user
<Files .htpasswd>
    deny from all
</Files>

The credentials for authorized users are stored in the .htpasswd file. This setup works as intended until a proxy is configured for the website. When the proxy settings are added to the virtual host (vhost) file, the .htaccess rules are bypassed and no longer enforced.

Steps to Reproduce

• Create a Entire website directory protection via Web Configuration -> Protected Directories.
• Proxy the website using Web Configuration -> Edit Proxy Website
• Observe that basic-auth password protection is no longer being applied to the website.

Expected Behavior

Access control should be enforced regardless of whether a proxy is configured for the website.

Actual Behavior

The .htaccess file is bypassed, allowing unrestricted access to the protected directory.

[jcameron]

I'm not sure if we can fix this unfortunately, as in Apache the .htaccess file only applies to access to content in that directory.

[KrisKnez]

I'm not sure if we can fix this unfortunately, as in Apache the .htaccess file only applies to access to content in that directory.

This issue can be addressed by transferring the directives from the .htaccess file into the virtual host (vhost) configuration file.

For instance, consider a .htaccess file located in the root directory with the following content:

AuthUserFile "/home/krisknez/domains/app.example.com/public_html/.htpasswd"
AuthType Basic
AuthName "Entire website"
require valid-user
<Files .htpasswd>
    deny from all
</Files>

These directives can be migrated into the vhost configuration as shown below:

...
# Password Protect While Proxying
<Location "/">
    AuthUserFile "/home/krisknez/public_html/.htpasswd"
    AuthType Basic
    AuthName "Entire website"
    require valid-user
</Location>
<Files .htpasswd>
    deny from all
</Files>
...

What do you think about this?

[jcameron]

Yes, that would work. However, it requires giving the domain owner permissions to edit the global Apache config, whereas the .htaccess files can be safely owned by the Unix users who own each domain.