Forum Moderators: phranque
1) Set up .htaccess in the directory to be secured.
AuthName "Restricted Area"
AuthType Basic
AuthUserFile /passwordpathpswd/.htpasswd
AuthGroupFile /dev/null
require valid-user
2) Set up .htpasswd in separate directory.
username:encrypted-password
3) Placed 401.html in root along with 404.html and 403.html
3) Simply could not get 401 to work. Found a reference that it needed to be named auth_failed.html - This did work. Brought up 401 page, with header and footer includes, as well as images.
4) However, the call for CSS file did not work at all.
5) CSS validation failed via URI or upload
I/O Error: The host name [www.example.com.auth_failed.html] couldn't be resolved. Details: "www.inlacebook.com.auth_failed.html"File not found: import file://localhost/css/css.css: Operation not permitted.
<link rel="stylesheet" type="text/css" media="all" href="css/css.css" />
6. Removing the CSS link and inserting the needed CSS into the head solved the problem.
Question 1: Why did 401.html fail but auth_failed.html succeed? Is this 'standard'?
Question 2: Why did CSS call fail, yet the two includes and the two images 'pass through'? (One of the images was in one of the includes and one was in the XHTML.) CSS failed entirely.
Question 3: 'Cancel' brings up the 401. However, can I 'force' the allowed number of entry attempts? If so, how? IE seems to vary. Sometimes it kicks out to the 401 after 3 bad attempts, sometimes 10. Opera seems to have no limit at all.
Question 4: A better or smarter way to do what I want? I seem to have everything working correctly, secured, and good to go, but would benefit from learning a little more. (Or a lot:))
<self-edit URL>
[edited by: D_Blackwell at 1:45 am (utc) on June 22, 2008]
ErrorDocument 404 http://www.example.com/404.html
ErrorDocument 403 http://www.example.com/403.html
ErrorDocument 401 /auth_failed.html
AddType application/x-httpd-php .html
Options -Indexes
<Files .htaccess>
order allow,deny
deny from all
</Files>
You were right about the CSS and the relative link. The 403 and 404 pass with that relative link sail through; they render and validate. If I call for it as an absolute path with the 401 it validates fine, and seems to process fine. (Admit, just a quick test thus far in IE only using the absolute path to the CSS and with the CSS removed from the head of the page.)
Why the CSS relative path failure for rendering and validation with only the 401 (named as auth_failed.html)?
Further suggestions, input, and 'best practice' advice?
All included files in the documents themselves should be absolute.
An absolute rule, or a preference? I've always been a relative path guy within my site structures. Have considered going absolute at times with some sites (includes, navigation, the whole shebang) to avoid potential nightmare of a major change in structure that would wreak havoc with a site - but have always figured that in that event I'll be doing some sort of major revamp anyway so it won't matter all that much. Of course, my sites run up to a few hundred pages max, not thousands like a lot of folks here.
<edit - spellin'>
[edited by: D_Blackwell at 3:13 am (utc) on June 22, 2008]
If the file that produces the error is in a subdirectory then relative paths will not work.
Likewise, the path in .htaccess must be relative to produce the correct status code.
Such is my understanding (but there are smarter people than me in this forum)
...
All ErrorDocument URLs MUST be relative (a local URL-path) -- otherwise a 302-Found status response will be returned regardless of the error condition being reported, as documented in the ErrorDocument documentation.
All links to pages and included object links within errordocuments MUST be absolute, since the errordocument "replaces" the the originally-requested resource, and "adopts" its URL (check the address bar when viewing an errordocument in response to an error). Otherwise, the client will resolve relative links within an errordocument based on the originally-requested URL (e.g. the address in the browser's address bar), and in many cases will therefore resolve to incorrect locations.
Jim
Ok.
1)
ErrorDocument 404 /404.html
ErrorDocument 403 /403.html
ErrorDocument 401 /auth_failed.html
AddType application/x-httpd-php .html
Options -Indexes
<Files .htaccess>
order allow,deny
deny from all
</Files>
2) Changing the include paths from relative to absolute blew them up - in the 404, 403, and 401. Backtracking to where I started with the relative paths (which always 'worked before' didn't help.?
So:
<?php
include ("http://www.example.com/includes/logo-header.inc");
?>
Didn't work; though it worked for the CSS file, and the images. Why not?
Did some more research (the error message helped):
<?php
include ("/usr/www/users/blackwel/domain-folder/includes/logo-header.inc");
?>
Does work and fixed the includes in all three files. Not sure what I've learned yet; still working on that:))
Why did the first absolute attempt not work and the second was successful? It was good enough for the other absolute paths. (I did try ("/includes/logo-header.inc"); - which did not work,but assume that that is not the 'real' absolute path in this case.)
Why have my relative includes always worked with the 404 and 403s (for years) and are still working on other domains, but now apparently 'blown up' on this one? (Looks like I've got some repair work to do on the other domains.?)
Why does auth_failed.html seem to be 'required', and 401.html does not work? Is this a unique requirement or standard?
Jim
$_SERVER['DOCUMENT_ROOT'] variable, i.e. include $_SERVER['DOCUMENT_ROOT'] . '/includes/logo-header.inc';
Why have my relative includes always worked with the 404 and 403s (for years)
Because they were redirecting due to the absolute URLs ;)
When an include is server-side, as it is for PHP or PERL or SSI, then the script is including the referenced object from the local filesystem on the server, and so should use a filepath, not an HTTP URL.
And a further clarification --maybe an eye-opener, or completely obvious-- but the fundamental purpose of a server is to translate "Universal" Resource Locators (ULRs) or, if you prefer, Universal Resource Indentifers (URIs) to server filepaths, regardless of the OS or filesystem in use on that server.
This is what URLs/URIs are for -- so that Web resources can be found without having to know what OS and filesystem they are hosted on. Imagine if the URL format had to change depending on whether the site was hosted on *nix, Solaris, Windows, etc... "No you dummy, it's not http://www.example.com/forum/post92.html, it's on Windows so everybody knows you have to use http://www.example.com/forum\post92.htm !"
Jim
ErrorDocument 403 http://www.example.com403.html
allowed my incorrect relative paths within those documents to 'work' - including the includes.
................
By incidentally calling for the ErrorDocument correctly:
ErrorDocument 401 /401.html
it seems that I blew up the ability to get away with at least some of the other errors.
................
I have updated, correctly I believe, the 404, 403, and added a 401 to another domain on another server.
Ran into the same issue on the includes, i.e., the absolute URL file path would not work. In this case also, the error message provided the obvious clue to the fix.
<?php
include ("/home/.funnygirl/d_blackwell/example.com/dbwd/logo.inc")
?>
and all is well again - and correct - and I getting closer to learning what it is that I have learned:))
................
Went back to the other domain on the other server and did some file renaming as a test. Turns out that it really does not care what I name the 401 file so long as my paths and references are correct.
................
You can also avoid relying on the system path remaining the same (and use a more 'url' like structure by using the $_SERVER['DOCUMENT_ROOT'] variable, i.e.include $_SERVER['DOCUMENT_ROOT'] . '/includes/logo-header.inc';
Beaten myself up enough for one day. May add 500s and try this method for them; if only temporarily for the experience. Probably ought to implement them all the same way when I'm done:))
................
Googling some research on this question brought up quite a lot of inconsistency in what is 'correct'. That didn't help at all.
................
Am I closer to 'having it'? Thanks to all.