Re: Ideas for password-protecting live site

On Tue, May 09, 2006 at 09:05:25AM +0100, Eric Carlson wrote:
> I have set up a site where resin manages the authentication in the
> usual way via a login box. I need to set up a staging server for the
> testers to be able to see whats coming next, so it needs to be as
> close to the live one as possible but only available to them. Hacking
> it too much just to deny unauthorised access means it isn't ;-) What I
> really want is the functionality I'd get by dropping a .htaccess file
> in my root dir, running mod_caucho & apache, and having apache pop up
> its password box once first, then the site appears as normal. I tried
> this and apache just ignored it (because jsp's bypass it?). Anyway,
> this and other ideas very welcome for what must be a common situation
> please. Thanks.

In your apache config, use a <Location> tag to define the URL as password protected or alternatively a <Directory> tag to define the protection of the root directory:


    <Directory /u/www/htdocs/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            Allow from all

            AuthType Digest
            AuthName "Private Area"
            AuthDigestDomain /
            AuthDigestFile /u/www/htdigest
            Require valid-user
            BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On
        </Directory>

-- 
trojanfoe