I am using .htaccess to password-protect a directory. When users attempt to log in, they enter a username and password, and are refused access --- but if they try a second time, they get in just fine (provided, of course, that the username and password are legitimate). I'd like them to succeed the first time.

I'm pretty sure this is being caused by the fact that there is another .htaccess file in a directory one level up.


The higher directory (call it "A") has a .htaccess that starts with

AuthName "Restricted Area"
RewriteEngine on

RewriteCond ....
RewriteCond ...
RewriteRule ...

The .htaccess in the directory I'm trying to protect looks like this:

AuthName "Password Required"
AuthType Basic
AuthUserFile [PATH TO .htpasswd HERE]
AuthGroupFile /dev/null
require valid-user

I tried changing the AuthName in directory B to match the AuthName in directory A, but this seems not to help. Is there an easy fix for this?

  • Have you tried just removing one of the AuthName directives? – Stephen Ostermiller Oct 4 '18 at 22:32
  • @StephenOstermiller : Yes. If I remove either one of them, the same behavior persists (users are asked to log in and then asked to log in again). If the one I remove is the one in directory B, there appears to also be a long lag before the content is displayed. If I remove both, an attempt to load the page yields a 500 error. – WillO Oct 4 '18 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.