PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Using Basic Authentication with Apache’s .htaccess Files
405
Listing 17.8 .htpass— The Password File Stores Usernames and Each User’s
Encrypted Password
user1:0nRp9M80GS7zM
user2:nC13sOTOhp.ow
user3:yjQMCPWjXFTzU
user4:LOmlMEi/hAme2
Each line in the .htpass file contains a username, a colon, and that user’s encrypted
password.
The exact contents of your .htpass file will vary.To create it, you use a small program
called htpasswd that comes in the Apache distribution.
The htpasswd program is used in one of the following ways:
htpasswd [-cmdps] passwordfile username
or
htpasswd -b[cmdps] passwordfile username password
The only switch that you need to use is -c. Using -c tells htpasswd to create the file.
You must use this for the first user you add. Be careful not to use it for other users
because, if the file exists, htpasswd will delete it and create a new one.
The optional m, d, p, or s switches can be used if you want to specify which encryption
algorithm (including no encryption) you would like to use.
The b switch tells the program to expect the password as a parameter rather than
prompt for it.This feature is useful if you want to call htpasswd noninteractively as part
of a batch process, but you should not use it if you are calling htpasswd from the command
line.
The following commands created the file shown in Listing 17.8:
htpasswd -bc /home/book/.htpass user1 pass1
htpasswd -b /home/book/.htpass user2 pass2
htpasswd -b /home/book/.htpass user4 pass3
htpasswd -b /home/book/.htpass user4 pass4
Note that htpasswd may not be in your path: If it is not, you may need to supply the
full path to it. On many systems, you will find it in the /usr/local/apache/bin
directory.
This sort of authentication is easy to set up, but there are a few problems with using
an .htaccess file this way.
Users and passwords are stored in a text file. Each time a browser requests a file that is
protected by the .htaccess file, the server must parse the .htaccess file and then parse
the password file, attempting to match the username and password. Instead of using an
.htaccess file, you could specify the same things in your httpd.conf file—the main