Member Avatar for wonderland

Hi,

I recently discovered .htaccess, and it works great for me :) Only problem I came across was utf-8 support.

I'm using .ht for password protection. And my pages is using utf-8 (I'm using letters like: ā, č, ē , etc). In "AuthName" I wrote a sentence in which uses letters like ā ū. When .ht window pops up that sentence is displayed wrong, it's readable, but not correct. So I wanted to ask is it possible to display those characters correct ? I'm having no problems with sites utf-8, but it's probably not connected.

And one more thing - is it possible to change default message of .htaccess (A username and password are being requested by blah blah . The site says: "blah blah") to something else ?

Thank you!

  • 2 Contributors
  • 2 Replies
  • 121 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by wonderland

Dani AI

Generated

Short version: the text you put in AuthName is sent as raw bytes in the WWW-Authenticate header and most browsers render that dialog with a platform/legacy encoding (or a UI font) — not reliably as UTF-8. That is why characters like ā/č/ē look wrong. You can change the realm (the AuthName string) but you cannot change the browser's fixed “A username and password are being requested by …” UI text.

Practical options and examples:

  • Keep the realm ASCII-only (simple, reliable).
  • Replace Basic auth with a form-based login so the login page can be UTF-8 and fully styled. Apache 2.4 has mod_auth_form + mod_session which lets you use an HTML login page, or roll your own PHP session/login page (common and simple).
  • Protect files without Basic auth by storing them outside the webroot and serving them through a script that checks a session. Example skeleton (secure properly before production):
<?php
session_start();
if (empty($_SESSION['user'])) { header('HTTP/1.1 403 Forbidden'); exit; }
$file = '/path/outside/webroot/' . basename($_GET['file']);
if (!is_file($file)) { header('HTTP/1.1 404 Not Found'); exit; }
header('Content-Type: ' . mime_content_type($file));
header('Content-Disposition: attachment; filename="'.basename($file).'"');
readfile($file);

Troubleshooting tips and cautions:

  • Use curl -I on the protected URL to inspect the WWW-Authenticate header bytes and confirm what your server is sending.
  • Saving .htaccess in UTF-8 may change the bytes sent but will not make browsers interpret the dialog as UTF-8 reliably.
  • ErrorDocument 401 can serve a custom HTML page but many browsers still show the native login dialog first.
  • Always use HTTPS with Basic auth (credentials are otherwise exposed).
  • As hinted, form-based auth gives full control of text/encoding; it is the best way to get correct UTF-8 messages and a custom UI for light protection like PDFs.

Recommended Answers

All 2 Replies

Member Avatar for cwarn23

The old .htaccess password protection. If your trying to protect information on your website then I would recommend setting up a php login system. And as for protecting pictures, simply place the pictures in a mysql database. But because of situations like this I would never recommend using the .htaccess file to protect custom made content. However just keep in mind there are some limitations for the old .htaccess file protection as well as minor advantages.

Member Avatar for wonderland

It's actually not that serious. I'm not trying to protect payable content or something like that . Just Some information not all visitors should see. Like some pdf. files etc.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.