Member Avatar for bsimms86

I'm running Apache2.2 on Ubuntu 10.04LTS. I can't seem to figure out how to have my password-protected directories show up in a directory listing. I am trying to create an environment where users can see all available directories, but have some of the directories password protected. When I add the AuthType, AuthName, AuthUserFile and Require options to either my virtual host or in a .htaccess file, the directory disappears from the listing. Is there a way to keep them visible? I'd prefer not to resort to scripting if I don't have to.
Thanks in advance.

  • 2 Contributors
  • 2 Replies
  • 318 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by bsimms86

Dani AI

Generated

Short answer: this is expected. When Apache’s auto-indexer builds a parent directory listing it performs internal subrequests to see whether each child is accessible; entries that return HTTP_UNAUTHORIZED/HTTP_FORBIDDEN are omitted by default. Apache 2.2 added an option to change that behavior so password-protected subdirectories can still be shown in the index. (httpd.apache.org)

If you want SALES to remain visible while still prompting for credentials when entered, add the autoindex option ShowForbidden at the directory level (either in the site’s <Directory> block or in a .htaccess if allowed). For example:

# put this in the parent directory config (or in a .htaccess if AllowOverride permits)
IndexOptions +ShowForbidden FancyIndexing HTMLTable

After adding it, reload Apache. If you put the directive in a .htaccess file, make sure the server’s configuration allows Indexes in .htaccess (AllowOverride Indexes or All); Ubuntu’s packages often set AllowOverride to None by default so you may need to change that in your site config. (httpd.apache.org)

Notes and cautions: ’s approach (put auth in the subfolder) is the right pattern for prompting on entry, but that’s why saw SALES disappear — it was being hidden by autoindex. ShowForbidden will display the protected directory in the listing, but clicking it will still trigger the authentication prompt. If you do not want to reveal the existence of protected areas, don’t enable ShowForbidden; instead provide an explicit (unprotected) index page that links to protected areas or use a scripted listing that controls visibility. (oreilly.com)

Recommended Answers

All 2 Replies

Member Avatar for phper

Try creating a .htaccess file in the folder you want to allow directory listing for. In that file add in your AuthType, etc - that way the user can click into the folder and when they do they'll then be prompted for the credentials.

Member Avatar for bsimms86

I've done exactly what you suggest, if I'm understanding you correctly. I probably could have done a better job explaining my situation. In my web-root, I've got a folder named DOWNLOADS (with no index.html file inside of it) and within that folder are three sub-directories: SALES, MARKETING and FLYERS. Now, when I navigate to DOWNLOADS with my browser, I get a directory listing showing SALES, MARKETING and FLYERS. So far, so good. But when I either add a .htaccess file (with the AuthType and other options) to SALES, or add the AuthType and other options to my virtual host configuration, navigating to DOWNLOADS returns a directory listing showing MARKETING and FLYERS. SALES just disappears. Is this normal for password-protected directory?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.