67

I'm working on blocking a folder with .htaccess, which I've never used before, and I'm having some trouble. Here's what I have

.htaccess (located in the folder I want blocked):

AuthName "Username and password required"
AuthUserFile /.htpasswd 
Require valid-user
AuthType Basic

.htpasswd (located at root, password is encrypted in actual file):

   tim:blah

I'm getting 500 Internal Server errors with this and I can't figure out why.

3
  • 2
    To you what is /.htpasswd, a file inside /home/youraccout/public_html or actually located on the main directory of the file system /?
    – Prix
    Commented Sep 27, 2013 at 21:51
  • 1
    What does your apache error logs say?
    – Jon Lin
    Commented Sep 27, 2013 at 21:52
  • I can't access error logs through my host =( and my .htpasswd file is in the uppermost folder I can access, it's not in my pubic_html folder
    – Tim Aych
    Commented Sep 27, 2013 at 22:04

8 Answers 8

168

Most likely problem is this line:

AuthUserFile /.htpasswd 

This line should provide full filesystem path to the password file e.g.

AuthUserFile /var/www/.htpasswd 

To discover your filesystem path, you can create a PHP document containing

echo $_SERVER['DOCUMENT_ROOT'];

7
  • 4
    Also make sure .htpasswd is not writeable by group and others.
    – anubhava
    Commented Sep 27, 2013 at 22:07
  • 4
    Found the home path. My host kind of hides essential information from me. Thanks.
    – Tim Aych
    Commented Sep 27, 2013 at 22:07
  • 4
    Thanks! In my case echo getcwd(); got me the (wrong) relative path. echo $_SERVER['DOCUMENT_ROOT']; worked well! Commented Oct 18, 2016 at 9:01
  • 3
    OK guys, this worked: I got the auth window opening up and logged in, but then got Internal Server Error. So I used the absolute path, solved. BUT, for the record, this is awful! I can't put this file in a git repo anymore because I can't use relative paths. Thanks Obama, thanks Trump! (relax, a little political humor :) Commented Jul 8, 2017 at 18:33
  • 1
    The internal server error problem solved using that echo function and setting path to the file. It works!
    – Jakub Muda
    Commented Mar 16, 2018 at 21:09
13

If nothing helped and you're using PHP you can make it work by putting this in your index.php (on top):

if (isset($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'])) {
    if ($_SERVER['PHP_AUTH_USER'] !== 'user' || 
        $_SERVER['PHP_AUTH_PW'] !== 'pass') {

        header('WWW-Authenticate: Basic realm="Protected area"');
        header('HTTP/1.0 401 Unauthorized');

        die('Login failed');
    }
}
3

Permissions can cause this issue too.

Make sure .htpasswd is readable by the web server user.

For instance, if you use nginx check the nginx.conf to find out what the server user is, if you use Apache you can find it out this way, etc.

Then set the right owners and read permissions to .htpasswd

3

If you see 500 Internal Server error these days - it's mostly due to the fact that in newer Apache versions the path in AuthUserFile has to be put inside quotation marks.

AuthUserFile "/var/www/somewhere/.htpasswd"
1
  • Works fine for me
    – Andrii
    Commented Mar 18, 2021 at 14:53
1

I have got same problem on Apache/2.4.6 (CentOS).

It turned out that Apache has some bug (https://bz.apache.org/bugzilla/show_bug.cgi?id=54735), and you need to set password from console like this:

htpasswd -nb username newpassw > <path-to>/.htpasswd

0

I would also add that some on some Web hosts, the .htpasswd file will not work if placed in a publicly accessible area. A recent installation I did confirmed this. As others have noted, it's best to place this in the root of the site.

1
  • 2
    "...best to place this in the root of the site" - Your last sentence appears to contradict your first (assuming by "root" you mean the document root)? As you suggest, this file should ideally be outside of the publicly accessible area. eg. above the document root.
    – MrWhite
    Commented Nov 7, 2016 at 11:24
0

Had the same problem, it had to do with access! Have you given ownership of the password file to www-data user through

chown www-data /var/www/.htpasswd
chmod 640 /var/www/.htpasswd

? It's best to keep the password, for obvious reasons, to keep the password somewhere outside the /var/www/ directory, let's say /home/MYSERVER/ in such a case you also need to give ownership of this parent directory to the user www-data.

0

Solved in .htaccess remove quote " and write full path for AuthUserFile then it will work.

Tested on xampp

AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile C:/xampp/htdocs/.htpasswd 
AuthGroupFile /
Require valid-user

.htpasswd

foo:bar

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.