Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

At the moment, I have a directory that's password protected by .htaccess and .htpasswd. The problem with this is that when a visitor comes to my site, they get an ugly inbuilt Secure Area message rather than going through a friendlier-looking login page.

The only other way I know to password protect online is using PHP files that redirect if the user doesn't have a login cookie, but the problem with this is that although it protects pages of the site, it doesn't protect other site content (such as image and PDF files).

How can I make sure that all files within a directory are protected by a login while still presenting that login in a user-friendly way?

share|improve this question

migrated from security.stackexchange.com Jan 22 '13 at 10:59

This question came from our site for Information security professionals.

1 Answer 1

You need to deny access to the files by the webserver - there's 3 ways to do this: move the files outside the document root, tell the webserver not to allow access to the files in the directory tree where your content resides or (if you're running PHP as a different uid than the webserver) change the permissions so only PHP can read them. Then you need to route all requests for the content via a PHP script which verifies the authenticated session of the user before serving the content. It's not rocket science.

It's made a bit simpler if you implement the PHP proxy script as the 404 handler.

The problem is that performance/capacity/throughput will be poor.

There are different things you can do to tweak the security / performance - but it depends on how much security / performance you need.

share|improve this answer
    
I've spent the last couple hours Googling for solutions based on keywords from your post, and I still don't understand a solution. You suggest that I use a "PHP script which verifies the authenticated session of the user." Could you (or anyone) please explain how to get this authenticated session in a user-friendly way in the first place? I need any method that makes sure the PDF can't be accessed on the open web and that allows me to add a user-friendly login page. Please explain or provide links. Thanks! –  3nafish Jan 23 '13 at 4:10
    
You said "I know to password protect online is using PHP files that redirect if the user doesn't have a login cookie" but now you're asking how to implement this? –  symcbean Jan 23 '13 at 11:27
    
Thanks for replying. I know how to prevent access to individual PHP pages with cookies (use the php setcookie() method, check if the user has a cookie, redirect to login page from any PHP page they try to access without the cookie), but as far as I can tell the .htaccess method (like that described at thesitewizard.com/apache/password-protect-directory.shtml) doesn't use cookies, but establishes some other sort of session instead. –  3nafish Jan 23 '13 at 14:23
    
Am I misinterpreting something? How do I interface between the two? The way I see it at the moment, if I use the first method, my PDF is still publicly accessible because I don't know how to redirect access like I would with a PDF, but if I use the second method and protect it with .htaccess, the browser gives only an inbuilt authentication message rather than letting me build a custom one. I suppose basically I'm asking how to take the cookie from PHP's setcookie() method and pass it into the inbuilt .htaccess prompt for directory access without that prompt ever appearing. –  3nafish Jan 23 '13 at 14:23
    
No - setcookie is not the answer - in order for this to be secure you need to verify the cookie value - PHP already has a mechanism for this - sessions. –  symcbean Jan 23 '13 at 23:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.