Member Avatar for Samyx

Hi Everyone,

I have a site that keeps asking for the apache server authentication before it gets to the actual login page. How can I eliminate the server authentication pop-up and use the actual login page (which is a form with username and password field) to allow selected user to access the content?

How can I modify the apache config so it doesn't ask me for authentication twice?

Thank you

  • 1 Contributor
  • 2 Replies
  • 225 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by Samyx

Dani AI

Generated

— short diagnosis and a few practical fixes.

The browser pop‑up is the native HTTP auth dialog: it appears when the server responds with a 401 plus a WWW‑Authenticate challenge. Confirm this quickly by requesting the protected URL with curl and looking for a WWW‑Authenticate header. (developer.mozilla.org)

Common causes (based on your description):

  • The POST target of your HTML form doesn’t match the Location that has SetHandler form-login-handler, so Apache never runs the form handler.
  • The login page or its handler URL is itself protected (or the AuthFormLoginRequiredLocation is configured as a filesystem path instead of a URL), so the server issues a native 401.
  • The HTML fields must use the names mod_auth_form expects (or you must set AuthFormUsername); avoid relying on PHP’s PHP_AUTH_* inputs for a form handler.
  • The mod_auth_form/mod_session modules must be enabled and the protected area must include the proper Require rules. (httpd.apache.org)

Minimal working pattern (illustrative):

<Location "/protected/">
  AuthType form
  AuthName "Members"
  AuthFormProvider file
  AuthUserFile "/etc/apache2/htpasswd"
  Require valid-user
  AuthFormLoginRequiredLocation "/login.html"
  Session On
  SessionCookieName session path=/
</Location>

<Location "/_auth/handler">
  SetHandler form-login-handler
</Location>
<form method="POST" action="/_auth/handler">
  <input name="httpd_username" />
  <input name="httpd_password" type="password" />
  <input type="submit" value="Login" />
</form>

If the browser still prompts, inspect responses (curl -i) and Apache logs; if you see WWW‑Authenticate: Basic then a Basic/Digest challenge is being sent by some parent config or module. As a last‑resort workaround you can remove that header for XHRs at the proxy level, but fixing the handler/login URL, field names, and AuthFormLoginRequiredLocation (must be a URL) is the correct solution. (httpd.apache.org)

Checklist for : confirm the form action matches your handler Location, use httpd_username/httpd_password (or set AuthFormUsername), and make AuthFormLoginRequiredLocation a public URL outside the protected scope.

Member Avatar for Samyx

Anyone?

Member Avatar for Samyx

This is my login form:

<form method="POST" action="/dologin">
<b>Username:</b>  <input type="text" name="PHP_AUTH_USER"><br>
<b>Password:</b>  <input type="password" name="PHP_AUTH_PW"><br>
</TD></TR>
<TR><TD align=center>
<input type="submit" value="Login">
</form>

This is my httpd config:

<Location /dologin.html>
    SetHandler form-login-handler
    AuthFormLoginRequiredLocation c:/webroot/login.html
    AuthFormLoginSuccessLocation c:/webroot/success.html
    AuthFormProvider file
    AuthUserFile conf/passwd
    AuthType form
    AuthName realm
    Session On
    SessionCookieName session path=/
</Location>

I am doinng this, but it still does not just use my custon login, it actually uses the apache authentication and then displays my login page.
What am I doing wrong?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.