Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I used cpanel on my hosted site to set up a password protected directory to allow downloads of specific files.

I send people a link to the file by email and include their username and password so they can authenticate and download the file.

When people use IE there is a warning message:

Warning this server is requesting your username and password be sent in an insecure manner...

This server is Apache. How can I stop this messsage appearing? Will SSL stop it? I would prefer to not have to use SSL.

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Yes, SSL is the answer. Without it their login and password are sent in plain text which is insecure. SSL encrypts their login information so it is secure from eavesdroppers.

share|improve this answer
add comment

This username and password are being sent in plain text over the network connection so it's vulnerable to packet sniffers like wireshark. As the wiki says:-

Although the scheme is easily implemented, it relies on the assumption that the connection between the client and server computers is secure and can be trusted. Specifically, if SSL/TLS is not used, then the credentials are passed as plaintext and could be intercepted.

So you would have to use some form of of SSL to prevent the warning from appearing.

All that said, for very basic security I use a program called Coffee Cup Website Access Manager which generates .htpaswrd files and and uploads them to a webserver and I've never experienced (or had a client experience) a security warning like the one you refer to.

share|improve this answer
    
Are you saying that with Coffee Cup you don't need SSL? –  CJ7 Mar 16 '12 at 12:17
    
That would appear to be the case, the question is why, I had always assumed that cPanel generated htpaswrd files, just like coffee cup. I'm just now researching the difference. What I can tell you is I've been using this software for 2 years and have never seen, nor has a client seen, such a warning. Will get back to you on the reason. –  toomanyairmiles Mar 16 '12 at 12:21
add comment

Either use SSL or switch to digest authentication. HTTP has supported digest authentication since HTTP 1.1, and pretty much all contemporary browsers (hopefully by now even lynx has added HTTP digest) support digest authentication. It's no more difficult to implement or any more taxing on the server or client, so there's really no more reason to continue using basic authentication.

It's sad that cPanel and so many other web hosts' control panels still default to basic authentication for whatever reason, but most cases (one of my few gripes with DreamHost is that they still default to basic authentication for SVN repos, and there's currently no way to change it manually) you can easily set up digest authentication on your own.

You just need to use htdigest to generate a password file and change the .htaccess configurations to:

AuthType Digest
AuthDigestDomain /private/
AuthDigestFile /path/to/.password_file

All the other HTTP authentication directives remain the same.

share|improve this answer
    
How do you change to digest authentication using cpanel? –  CJ7 Mar 16 '12 at 15:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.