.htaccess dilemma

[64]

So I want to password protect one of my websites, which I've done through cPanel to password protect that whole directory. However, inside the site directory that I'm locking is a subdirectory that I want public. Is there any way to do this, or am I fucked?

[Jon-86]

It cant be done. You will just have to move the files you want public outside of the protected directory.

The only thing I can think of would be to move down one level and restrict access to everything except what you want made publicly accessible.

[64]

Can you restrict a specific file rather than a directory?

[Jon-86]

You should be able to do something like that in Linux easily enough, I know in Windows setting up security policies can be a pain in the arse. But this page is a good starting point since I dont know exactly what your trying to do: http://wiki.eits.uga.edu/campuswebhelp/i ndex.php/Restrict_Access_to_Your_Pages

[64]

Well my server is Unix, so I guess that's good. Everywhere I go to find out how to lock a particular file, it gives me this code:

<Files index.php>
Order deny,allow
AuthType Basic
AuthName "my site name"
AuthUserFile "password file location"
Require valid-user
</Files>

It works, but it doesn't prompt to enter a username and password. It just goes straight to the 401 error. I really only need this page to be locked, which would be convenient so it doesn't keep prompting for every damn subdirectory it has to access.

[Jon-86]

So why not just have that single file in a directory and password protect that?

[64]

At 11/1/09 05:19 PM, Jon-86 wrote: So why not just have that single file in a directory and password protect that?

Because it's the index file of the site.

[Jon-86]

At 11/1/09 05:57 PM, 64 wrote:

At 11/1/09 05:19 PM, Jon-86 wrote: So why not just have that single file in a directory and password protect that?

Because it's the index file of the site.

So your basically telling me you want to password protect the /www directory? Any particular reason for that? Your best hope here is to just put what you need hidden in a directory below the /www directory and password protect that.

If what you were trying to achieve was possible it would defeat the purpose of a protected directory as if someone could then access one file in it, what would stop them from accessing others? If that makes sense.

[henke37]

One thing for sure, no standard forbids him from having as he wants it. Each http resource has it's own access rights.

[Gawdl3y]

You can do that by requiring authentication for the directory you're talking about, then including a file with something saying to allow the subdirectory.

Example of .htaccess in the subdirectory you want to allow:
Order allow,deny

I haven't done any restrictions in a while, so I think that would work... But I'm pretty good with URL rewrites, so you can ask me pretty much anything about those! :D