Protecting Flarum with password using .htaccess

segfault79

Hi to all! Sorry to bother you, but i'm trying to make my flarum private for testing purposes. I'm struggling with apache authentication.

Here's the situation:
1. i have an empty document root with a "flarum" subdir with flarum beta4 freshly installed. Everything work like a charm.
2. i put a custom .haccess with his fellow .htpasswd inside the empty document root with the following lines:

AuthName "Secure Area"
AuthType Basic
AuthUserFile /path/to/.htpasswd
require valid-user
Allow from all

...and everything SEEMS to work fine, Apache it asks me for the login and after that I can freely browse my flarum. But when it comes to post a new discussion the system keeps asking me for authentication (Apache auth, not flarum's) and there's no way to go ahead. Can anyone please give me a tip to solve this issue?

Thank you in advance,

:-)

luceos

segfault79 you probably have to filter to make this basic authentication only work when not requesting the API endpoint..

Flarum has two sides, frontend and backend. The frontend is talking to the backend continuously using an API (yourforum.com/api). The api is not built to support basic authentication yet. So you'd have to whitelist that url from being protected for now.

Maybe this helps: http://stackoverflow.com/questions/8697706/exclude-one-folder-in-htaccess-protected-directory

luceos

Franz that might be the case segfault79 might try out the dirty fix supplied in that issue to see whether it works for him.

Franz

I wonder if this could be related to this issue.

segfault79

I've finally managed to make it work :-)

here's the lines I appended to the .htaccess inside flarum directory:

SetEnvIf Request_URI ".*api.*" allow

AuthName "Secure Area"
AuthType Basic
AuthUserFile /path/to/.htpasswd
Require valid-user
Order allow,deny
Allow from env=allow
Satisfy Any

For some weird reason, though, this is not working on Microsoft Edge. On Google Chrome, it works flawlessly. I've not tried on other browsers.

Thank you all for the support!
Bye

Franz

segfault79 Wouldn't that mean I can get around this check by appending ?HACKapiHACK=1 to any URL?

segfault79

Franz No... The query string is not returned by Request_URI. Apache site says:

Request_URI - the resource requested on the HTTP request line -- generally the portion of the URL following the scheme and host portion without the query string. See the RewriteCond directive of mod_rewrite for extra information on how to match your query string.

So, unless the "api" string is part of the domain name (and in this case it should be enough to add a "/” to the SetEnvIf regexp) I think this should be working as intended.

Franz

segfault79 Okay, good. What about URLs like foo/index.php/api/something? PHP supports PATH_INFO...

segfault79

Good point! :-D

These two lines should avoid the problem. I just tried and seems to work fine.

SetEnvIf Request_URI "^/api/.*" allow
SetEnvIf Request_URI "^/api$" allow

yekenuk

Do you guys still use this code? Did you get anywhere with Edge?

Cheers!