[SOLVED] localhost/xampp won't ask for authentication

Problems with the Windows version of XAMPP, questions, comments, and anything related.

[SOLVED] localhost/xampp won't ask for authentication

Postby piadph » 29. June 2015 10:55

I have a problem with security setup for xampp.
I have set up a password for both, xampp pages and phpMyAdmin (statuses are all green under localhost/security/index.php).
When I try to connect to phpMyAdmin, everything is ok, it asks me for username and password. The problem occurs when I access localhost/xampp.
It connects without any authentication.
I tried clearing all history/cookies/cache in the browser and restarted apache and mySQL modules.

I have checked in C:/xampp/htdocs/xampp for the .htaccess file. It is there and it contains:

AuthName "xampp user"
AuthType Basic
AuthUserFile "C:\xampp\security\xampp.users"
Require valid-user

Authentication type is set to 'cookie'.

So what I'm trying to do is:
- limit access to localhost/xampp site, so only authorized users can see it
- if possible ask for username/password every time I try to access the site or access security page

What am I missing here?


*I also tried creating another .htaccess file in "C:/xampp/htdocs" just to see what happens. It still accesses localhost/xampp without asking for username/password, but it does ask when I try to access localhost/mantis (is in "C:/xampp/htdocs/mantis" )
Last edited by piadph on 30. June 2015 08:49, edited 1 time in total.
piadph
 
Posts: 2
Joined: 29. June 2015 10:19
Operating System: Windows

Re: localhost/xampp won't ask for authentication

Postby JJ_Tagy » 29. June 2015 13:17

Did you check the contents of C:\xampp\security\xampp.users ?

Maybe you saved username/password in browser or still have browser running when you clear the cache?
JJ_Tagy
 
Posts: 678
Joined: 30. January 2012 13:44
Operating System: Windows 10 Pro x64

Re: localhost/xampp won't ask for authentication

Postby gsmith » 30. June 2015 06:09

Why is explained in the comment at the very bottom of c:/xampp/apache/conf/httpd-xampp.conf

c:/xampp/apache/conf/httpd-xampp.conf wrote:#
# New XAMPP security concept
#
<LocationMatch "^/(?i:(?:xampp|security|licenses|phpmyadmin|webalizer|server-status|server-info))">
Require local
ErrorDocument 403 /error/XAMPP_FORBIDDEN.html.var
</LocationMatch>

#Now, in http-xampp.conf the new security concept tells Apache to allow local connections. There is an implied <RequireAny> in Apache 2.4. It's is hard to find and buried in http://httpd.apache.org/docs/2.4/mod/mo ... _core.html
#When multiple Require directives are used in a single configuration section and are not contained in another authorization directive like <RequireAll>, they are implicitly contained within a <RequireAny> directive.
#Therefore when you add your Require valid-user to your htaccess, what Apache sees is this;
#<RequireAny>
#Require local
#Require valid-user
#</RequireAny>


So it is going to require any one of the two possibilities. When you are on the computer running Xampp, you are on the "local" machine and therefor it will not ask for username/password because you are allowed in by Require local statement.
gsmith
 
Posts: 194
Joined: 29. November 2013 18:04
Location: San Diego
XAMPP version: 0.0.0
Operating System: Win XP to 2012R2/VS 6,9,11,14

Re: localhost/xampp won't ask for authentication

Postby piadph » 30. June 2015 07:19

Thats it!
So I've replaced the "Require local" with

<RequireAll>
Require valid-user
Require local
</RequireAll>

and it works. :)

Thanks!
piadph
 
Posts: 2
Joined: 29. June 2015 10:19
Operating System: Windows


Return to XAMPP for Windows

Who is online

Users browsing this forum: No registered users and 55 guests