Member Avatar for samarudge
samarudge 16 Posting Whiz

Hi,
I am trying to HTTP Auth protect a directory in my cgi-bin directory. I have a .htaccess file:

AuthUserFile /var/www/cgi-bin/secure/.htpasswd
AuthGroupFile /dev/null
AuthName "uTutorial Console"
AuthType Basic

<Limit GET POST>
require user valid-user
</Limit>

When I put this .htaccess file in an ordinary directory e.g. /var/www/html/site/secure/.htaccess it works fine and asks for the username and password however when I put it in my secure CGI directory (/var/www/cgi-bin/secure/) it doesn't ask for user/pass just shows the script. Is this a common problem or is it something to do with DIR permisions?

  • 1 Contributor
  • 0 Replies
  • 118 Views

Dani AI

Generated

— this is a common trap: Apache usually treats the cgi-bin location as a special, server-controlled area (often set with ScriptAlias) and many distributions set AllowOverride to None there. That means any .htaccess you drop into a cgi-bin subdirectory will be ignored, so authentication never runs even though the same .htaccess works in a normal document directory.

Resolution options:

  • Enable per-dir overrides for auth in the main config (edit apache2.conf/httpd.conf) or move the auth into the server config with a Directory/Location block and restart Apache. For example, allow overrides for that tree:
    <Directory "/path/to/cgi-bin">
  AllowOverride AuthConfig
</Directory>

    Or put the auth directives directly in the server config for the secure folder:

    <Directory "/path/to/cgi-bin/secure">
  AuthType Basic
  AuthName "Protected"
  AuthUserFile /path/to/.htpasswd
  Require valid-user
</Directory>

Troubleshooting checklist:

  • Confirm the ScriptAlias/Directory settings for your cgi-bin (see Apache ScriptAlias docs) and whether AllowOverride is None (see AllowOverride docs).
  • Check loaded modules (e.g., apachectl -M) for mod_auth_basic/mod_authn_file.
  • Tail the error log while requesting the URL — Apache will log .htaccess parsing / permission messages.
  • Watch for an auth-directive typo: in Apache 2.4 the correct directive is Require valid-user (older 2.2 used lowercase require valid-user); a wrong token can make the file ineffective.

If you cannot change server config (shared host), either move the script out of the ScriptAlias tree into an ordinary directory with ExecCGI enabled, or implement auth inside the CGI itself. Apache docs on htaccess and authentication are useful references: htaccess howto and AllowOverride.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.