Apache Password Protection Security Issue

Discussion in 'Apache' started by Harold Clements, Apr 30, 2022.

  1. #1
    I have an issue with login into my website using Apache .htaccess password over HTTPS.
    If I visit my site over https, the site comes up with a login dialog, but the browser has the little 'i' saying that it is not secure.

    If I press escape, I now have a secure connection (little padlock) and can login. However, once I have logged in successfully, I have a 401 error.

    If I then reload the page, everything is as it should have been if I had logged in successfully the first time.

    My .htaccess file looks like this:

    AuthName "Title"
    AuthType "Digest"
    AuthUserFile "/volume1/web/passwd/normal.pw"
    Require valid-user


    And I have setup my password credentials using this tutorial

    My server is a Synology NAS. Unfortunately there support is telling me it's the .htaccess file that is 'probably' redirecting incorrectly. I pointed out that I was using their tutorial and despite not having in depth knowledge on Apache .htaccess scripting, I don't see any redirecting and also I have followed their tutorial. Their response was to say that .htaccess files are not part of their remit. I am pretty sure the issue is not with the .htaccess file.

    Therefore I am asking this great community for help and suggestions.

    Thanks for your time, Harold
     
    Harold Clements, Apr 30, 2022 IP