1

I used cpanel on my hosted site to set up a password protected directory to allow downloads of specific files.

I send people a link to the file by email and include their username and password so they can authenticate and download the file.

When people use IE there is a warning message:

Warning this server is requesting your username and password be sent in an insecure manner...

This server is Apache. How can I stop this messsage appearing? Will SSL stop it? I would prefer to not have to use SSL.

3 Answers 3

1

Yes, SSL is the answer. Without it their login and password are sent in plain text which is insecure. SSL encrypts their login information so it is secure from eavesdroppers.

0

This username and password are being sent in plain text over the network connection so it's vulnerable to packet sniffers like wireshark. As the wiki says:-

Although the scheme is easily implemented, it relies on the assumption that the connection between the client and server computers is secure and can be trusted. Specifically, if SSL/TLS is not used, then the credentials are passed as plaintext and could be intercepted.

So you would have to use some form of of SSL to prevent the warning from appearing.

All that said, for very basic security I use a program called Coffee Cup Website Access Manager which generates .htpaswrd files and and uploads them to a webserver and I've never experienced (or had a client experience) a security warning like the one you refer to.

2
  • Are you saying that with Coffee Cup you don't need SSL?
    – CJ7
    Mar 16, 2012 at 12:17
  • That would appear to be the case, the question is why, I had always assumed that cPanel generated htpaswrd files, just like coffee cup. I'm just now researching the difference. What I can tell you is I've been using this software for 2 years and have never seen, nor has a client seen, such a warning. Will get back to you on the reason. Mar 16, 2012 at 12:21
0

Either use SSL or switch to digest authentication. HTTP has supported digest authentication since HTTP 1.1, and pretty much all contemporary browsers (hopefully by now even lynx has added HTTP digest) support digest authentication. It's no more difficult to implement or any more taxing on the server or client, so there's really no more reason to continue using basic authentication.

It's sad that cPanel and so many other web hosts' control panels still default to basic authentication for whatever reason, but most cases (one of my few gripes with DreamHost is that they still default to basic authentication for SVN repos, and there's currently no way to change it manually) you can easily set up digest authentication on your own.

You just need to use htdigest to generate a password file and change the .htaccess configurations to:

AuthType Digest
AuthDigestDomain /private/
AuthDigestFile /path/to/.password_file

All the other HTTP authentication directives remain the same.

1
  • How do you change to digest authentication using cpanel?
    – CJ7
    Mar 16, 2012 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.