2

I have a protected directory on an hosted IONOS server. It correctly works when the correct credentials are entered, but when a user hits cancel, it redirects that user to the hosting provider's promo default page.

eg. https://initiostar.co.uk/ticker/OmniTicker.7z

eg current htaccess 

AuthUserFile /path/to/the/password/file/.htpasswd
AuthType Basic
AuthName "Protected Page"

<Files "index.php">
Require valid-user
</Files>

If the user hits cancel you are redirected to the host's default page. Tried adding a default, but I doubt this is the way to it.

DefaultIndex [filename]

Preferred outcome: popup box opens in a small window on the web page and where cancel is executed, it closes the popup and stays on the same page.

For anyone working with Apache I assume this is standard stuff, but not for me.

Improve this question
1
  • You aren't being redirected anywhere. The ultimate URL is exactly the same URL as the one you provided.
    – Steve
    May 27, 2020 at 22:01

1 Answer 1

Reset to default
2

Aside: The code you posted only blocks access to index.php, not OmniTicker.7z (assuming this is a physical file), so you either have other code that blocks this, or the file is entirely virtual and you are managing the download through index.php (although other code is also required to do this)?

When you hit "Cancel" on the HTTP Authentication password prompt you are served a "401 Unauthorized" response. It looks like your host has configured this response to serve a parked/advertising page (this is not an external "redirect", as @Steve mentioned in comments).

You should be able to override this response in .htaccess using the ErrorDocument directive to create your own custom 401 response (just like a custom 404). For example:

ErrorDocument 401 /errordocs/my-custom-401.html

(Although I see in your earlier question that you already/previously had an ErrorDocument 401 directive defined?)

You can also try resetting the error document to the Apache default:

ErrorDocument 401 default

...it closes the popup and stays on the same page.

If by "same page", you mean the page that contained the link to OmniTicker.7z, then... when you request OmniTicker.7z in the browser, you have essentially moved away from the current page. Any response from the server (eg. 401 Unauthorized or the download itself, if authorized) will then replace the current page. The only way to stay on the "same page" is to somehow abort the request at the client end, "redirect" back to the previous page or use a different authentication modal. The easiest method is to display a custom 401 response (as mentioned above) with a link back to the previous page.

Improve this answer
2
  • Many thanks and a great observation. I found through inspect the 401 error and added a 401 error page which resolved the issue. The previous 401 redirect used a link to mysamedomain which did not work. I reverted to " /401.htm" in the same directory which does work. I spoke to IONOS and said it cannot be acceptable that hitting a cancel button on a protected directory alert results in a sedo parking popup. I would have thought from their side the default should be back to the page from where the request was made. Thanks Gary
    – Gary Lowrey
    May 28, 2020 at 22:11
  • "The previous 401 redirect used a link to https://mysamedomain which did not work" - if you specify an absolute URL (ie. with a scheme + hostname) to the error document then it triggers a 302 redirect, which is generally undesirable. "it cannot be acceptable" - yes, I agree entirely, very cheeky/blackhat. It is also a potential security vulnerability as it could leak sensitive information to an untrusted third party script. The "default" should be the default Apache 401 response.
    – MrWhite
    May 29, 2020 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.