Viewing Thread:
"htpasswd timing out"

This is strange.

I have a .htpasswd protecting the admin area of my site(s) but it is timing out.

I thought the auth was valid until you cleared your cache.

Any ideas?

Neil

Happened again in a clear test directory on my VIP space with the .htaccess and an index.html.

I would have tried it on a standard area but I needed to change the auth file full path to root and I forgot the syntax and can't find it in the help files.

N.

I was OK on FF 3.5.7 - I've just upgraded to 3.6 and I'm waiting to see if my pages timeout...


EDIT: All seems fine on FF 3.6 to me!
Over 30 mins and still not timed out.

Have you tried setting up a test directory without Joomla and see how you get on?

I would test a Standard and a VIP web space...




[s]Hmmm...[/s]

It looks like it's Firefox 3.6.

I tried in Safari and didn't get any problems.

N.

Neilj99 wrote:
> To clarify:
> I said that Joomla admin sessions (cookie based) and htpasswd
> basic auth are totally different.


Arh - I missed/didn't see/can't find that... ;¬)
[s]Hmmm...[/s]

To clarify:

I said that Joomla admin sessions (cookie based) and htpasswd basic auth are totally different.

N.

Neilj99 wrote:
> ...Joomla... "Totally different".



I thought you said it was Totally different ! :¬P
[s]Hmmm...[/s]

This is most intreaguing; really beginning to bug me, but intreaguing.

I wonder if it's just one extension that's doing it? It's a hits/stats counter called JoomlaWatch.

N.

Just a quick run through how Basic Authentication works for those who may read this and don't understand what Neil is on about.
When you password protect a directory on our VIP+ Hosting this sets up the .htpasswd file for you.
When someone tries to visit the password protected directory the web server responds back to the browser with a 401 'Unauthroized' message. This causes the browser to display a username and password prompt.
Once the user has typed in their username and password and submitted the data the browser caches these details and then sends them back to the web server in an 'Authorized' HTTP header every time the user requests a resource from the password protected directory, thereby giving the 'illusion' that they a logged in.
The web server does not track the time or session with this method it just checks the details in the 'Authorized' header against the .htpasswd file and either serves the page or returns a 401 header if the details don't match.

In Neilj99's case it seems that either his browser is dropping the Auth details from it's session for some reason or at some point the Joomla Admin system modifies the headers sent back to the server and drop the auth details, causing the server to issue the 401 header and login being requested again. I'm pretty certain this has nothing to do with the server itself.

Many thanks.

N.

Sorry completely missed this today. Was doing a few tests and playing about with my test site.

Either way I can't help myself, I'll get someone to look if they can tomorrow.