Apache Friends Support Forum

I'm struggling for a couple of days to get a file password protected for download. I've created an .htaccess and an .htpasswd file for this.

.htaccess

Code: Select all

AuthUserFile C:\xampp\htdocs\Test\downloads\.htpasswd
AuthType Basic
AuthName "My Secret Folder"
Require valid-user

.htpasswd

Code: Select all

PIM:$apr1$ouCx1Nsv$lC9445ysbdHXCf4XlriDW/

Both files are stored in donwloads folder and together with the file B747-4.xlsm

The link to the file is as follows:

Code: Select all

<a href='downloads/B747-4.xlsm' class="read-more" target="_blank">DOWNLOAD</a>

When I hit the above link the file is downloaded without requesting for a password.

The rewrite module in the httpd.conf file is commented out (enabled)

Code: Select all

LoadModule rewrite_module modules/mod_rewrite.so

And all instances of AllowOverride are set to All

This is the first time I'm trying to password protect a file so maybe I am missing something. all help is welcome!

How do you call the file in your browser, which contains the link to that download file? What do you enter into your browser?

Anyway, you should *not* apply a relative link in your file (like href='downloads/B747-4.xlsm'), instead apply a fully qualified URL (like href='http://localhost/downloads/B747-4.xlsm' or whatever your servername and location is).

P.S.: As i just can see, you stored the .htpasswd file into the same folder, which is protected. That does not work anyway, because Apache cannot open that file, as the folder is protected. You should put the file .htpasswd one level above or somewhere else, but not into the same folder, which is to protect.

Also, a very common error is a spelling error of .htaccess - very often it is accidently called .htacces or it has an extension, like .htaccess.txt or similar. Check this as well.

Hello Nobbie!

That's:

Code: Select all

localhost/Test/ldsxls.php

I tried changing the link like suggested but without luck.

Code: Select all

http://localhost/Test/downloads/B747-4.xlsm

It still downloads the file without a prompt for password

I put an P.S. to my post, please check that also.

I moved the .htpasswd file one level up and adjsuted the link in the .htaccess file

Code: Select all

AuthUserFile C:\xampp\htdocs\Test\.htpasswd

I tripple checked the spelling of both files.
None of the files has a txt extension but only carry their name as extension.

Insert a stupid token into .htaccess (lblablabla), if .htaccess is recognized, this should issue a server error 500. I think, your .htaccess is completely ignored for some reason, but i cannot see from here, why it is ignored.

You're right, it seems to be ignored, nothing happened after putting some nonsense in the htaccess file.
I am really stuck

Which editor do you use for editing .htaccess?

Notepad++

After saving it I checked the type of the file (HTACCESS-file)

Noteüad is known for automatically appending .txt to files. Usually, Windows Explorer does NOT show .txt extensions, as it does not show file extensions for known file types. What does Explorer show for the file type of .htaccess file? Usually files are shown with file types (for example "Wave file" or similar for *.wav etc.)

Last not least, the name of ".htaccess" is not hardcoded in Apache, it is part of the configuration, Someone may choose any other filename. Maybe it is configured for a different name. Or there may be a <Files ...> clause in your configuration, which tells Apache to ignore .htaccess files. Do you use a fresh Xampp installation, or is there already installed anything?

Windows does not show the extension by by selecting the file, the type is shown and in my case it shows (HTACCESS-file)
I just installed Xampp today (First time)

Nobbie wrote:Noteüad is known for automatically appending .txt to files.

Yes, Windows Notepad, but not Notepad++

Read https://httpd.apache.org/docs/2.2/howto/htaccess.html and try to find out, if the default name .htaccess has been changed. I am out of ideas, sorry.

Thank you for trying Nobbie! Have a nice day.