You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2024/02/08 15:36:12 UTC
[Bug 68602] New: mod_auth config file breaking htaccess basic auth
https://bz.apache.org/bugzilla/show_bug.cgi?id=68602
Bug ID: 68602
Summary: mod_auth config file breaking htaccess basic auth
Product: Apache httpd-2
Version: 2.4.37
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: mod_auth
Assignee: bugs@httpd.apache.org
Reporter: jonathan.archdale@blacknight.com
Target Milestone: ---
Issue
-
When enabling a Require rule to manage bot access / whitelists, via a config
file in /etc/httpd/conf.d/block.conf, basic auth via a .htaccess is no longer
honoured.
This same method detailed below was previously used on apache 2.2, using 'Deny
from env=BlockBot', 'Allow from env=Whitelist' without issue. It appears that
this functionality may have become broken in the switch to the new 2.4 auth
format.
To replicate
-
Install httpd
using basic default vhost provided by base config, with allowoverride enabled
for .htaccess use:
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
# Create test file and confirm working:
echo test > /var/www/html/index.html
:~$ curl http://x.x.x.x/index.html
test
# Created htaccess w/ basic auth:
AuthType Basic
AuthName "Protected dir"
AuthUserFile "/var/www/html/.passwd"
Require valid-user
# Pass file w/ test:testtest
test:{SHA}Uau5Y2B43vv4iNhFenx2+FyPEUw=
# Confirm prompts for auth:
:~$ curl http://x.x.x.x/index.html -I
HTTP/1.1 401 Unauthorized
:~$ curl http://x.x.x.x/index.html -u test:testtest
test
#Add Block, which blocks based on a 'badbot' env variable, or allows via use of
env variable 'whitelist' - which customers use to allow otherwise blocked bots
through. Full use-case slightly more complex, but simplified for demo
purposes:
# cat /etc/httpd/conf.d/block.conf
<Location />
<RequireAny>
<RequireAll>
Require env Whitelist
</RequireAll>
<RequireAll>
Require all granted
Require not env BlockBot
</RequireAll>
</RequireAny>
</Location>
# restart apache and test:
:~$ curl http://x.x.x.x/index.html
test
# Removing the config file resolves the issue and reinstates the basic auth.
Notes
-
I am unclear if this is an issue with how I have implemented this, or if I've
come across a bug - however no permutation I have tried has resolved this
issue. If it is an implementation issue, could you please let me know how I
should be handling the access control in a scenario where I want to block a
given env var across all vhosts, with a whitelist set via .htaccess at a
customer level as shown above.
Thank you for your time.
Regards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68602] mod_auth config file breaking htaccess basic auth
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68602
jonathan.archdale@blacknight.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |CLOSED
--- Comment #2 from jonathan.archdale@blacknight.com ---
Hi Eric,
Thanks for your help. It's always something simple in the end; the addition of
'AuthMerging And' to the location stanza has resolved the issue whilst
maintaining the existing functionality.
Thanks for your help.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68602] mod_auth config file breaking htaccess basic auth
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68602
--- Comment #1 from Eric Covener <co...@gmail.com> ---
It's not intuitive, but Location is evaluated after Directory/htaccess so the
configuration takes precedence.
Maybe "AuthMerging and" in your .htaccess gives you the result you want?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68602] mod_auth config file breaking htaccess basic auth
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68602
--- Comment #3 from ryodan <th...@fthcapital.com> ---
https://docs.astro.columbia.edu/search?q=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://pwonline.ru/forums/fredirect.php?url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://www.oculus.com/lynx_warn/?u=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://tributes.smh.com.au/obituaries/435378/mark-daniel-coughlan/?r=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://book.douban.com/link2/?url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://med.jax.ufl.edu/webmaster/?url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://bbs.vivo.com/in/link?target=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://guru.sanook.com/?URL=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://prezi.com/url/?target=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://left.engr.usu.edu/chanview?f=&url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://www.figma.com/exit?url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://go.soton.ac.uk/public.php?format=simple&action=shorturl&url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://minecraft.curseforge.com/linkout?remoteUrl=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://captcha.2gis.ru/form?return_url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://forums.botanicalgarden.ubc.ca/proxy.php?link=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://info.scvotes.sc.gov/Eng/OVR/Help.aspx?returnLink=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://sdx.microsoft.com/krl/addurlconfirm.aspx?OS=6.1.7601&SP=1.0&ClientVer=15.4.3555.0308&type=ots&url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://www.crunchyroll.com/fr/external_redirect?url=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://sd39.senate.ca.gov/sites/sd39.senate.ca.gov/files/outreach/common/sd39-atkins-redirect.php?URL=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
https://ecms.des.wa.gov/ECMSUserManager/ForgotPassword.aspx?system=5&startURL=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
http://mel.ess.ucla.edu/radarwiki/api.php?action=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
http://ufldl.stanford.edu/wiki/api.php?action=https://community.wongcw.com/blogs/171924/All-You-Want-To-Know-About-Gogoanime
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org