.htaccess challenging non-protected area

audiodef

I set up an .htaccess file for an administration area of one of my sites. I've had users complain to me that they are getting an HTTP challenge when they are visiting the main site. I can't see why. This is my .htaccess file:

eccerr0r · Posted: Wed May 23, 2012 3:18 pm Post subject:

I do get a prompt to enter a user/password by http://audiodef.com for "Synthetronica Administration"
Hitting "cancel" allows opening the main page.

Is this .htaccess for this main page or a parent directory of the page?

I also see this basic auth challenge on your http://audiodef.com/projects.php?project_id=1 link in your signature as well as the main audiodef.com page.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

audiodef · Posted: Wed May 23, 2012 3:41 pm Post subject:

This is not good.

I just tried removing the Piwik code from one of my sites and a user was able to go there without getting an auth challenge.

This is the code, straight from Piwik's control panel:

eccerr0r · Posted: Wed May 23, 2012 3:57 pm Post subject:

I didn't check if I got a 401 on those basic auth pages by cancelling them (probably though). Still looks like an htaccess issue rather than javascript...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

Hu · Administrator Joined: 06 Mar 2007 Posts: 23066

The server should not serve any password-restricted resource if you do not supply the password. Since the page appears to be served, I suspect that the main page is not restricted, but that it includes one or more resources (images, scripts, etc.) that are restricted. When you refuse to give a valid user, those secondary resources are withheld, but the site is sufficiently complete that the difference is not obvious. I suggest using a web development tool, such as Firebug (if using Firefox), to inspect all the HTTP transactions initiated when visiting the main page. That should show you which resource(s) are restricted.

audiodef · Posted: Thu May 24, 2012 1:46 pm Post subject:

I posted to the Piwik forums and got a response from an admin. If you .htaccess-protect the Piwik dir, all sites tracked by Piwik will produce an auth challenge. I've thus decided to look into using an Apache directive instead of .htaccess to prevent stray users from seeing my Piwik page.
_________________
decibel Linux: https://decibellinux.org
Github: https://github.com/Gentoo-Music-and-Audio-Technology
Facebook: https://www.facebook.com/decibellinux
Discord: https://discord.gg/73XV24dNPN