Beefy Boxes and Bandwidth Generously Provided by pair Networks
good chemistry is complicated,
and a little bit messy -LW

Re: cgi and https (mildly off topic)

by Spenser (Friar)
on Nov 27, 2001 at 10:56 UTC ( #127747=note: print w/replies, xml ) Need Help??

in reply to cgi and https (mildly off topic)

As Dogma has alluded to, .htaccess can be problematic when dealing with many users and a lot of usage. Besides what has already been pointed out here, .htaccess also has a problem with repeated verification. Once a user enters a directory containing a .htaccess file, the browser is called upon to provide user name and password for each page requested. The user is only asked once, but the browser, behind the scenes, is having to authenticate with each page requested. This slows things down a bit and could be a real drain on the system with a large number of users.

A good alternative to .htaccess is to modify the Apache configuration file. In RedHat Linux 7.0 it's /etc/httpd/conf/httpd.conf. Check the man pages for httpd on your system, if different. The advantage is that when you enter the protected directory, authentication is conducted only once and not repeated with each page retrieved. This option may not be available, though, if you're renting space on someone else's server.

Assuming you do have access to httpd.conf, here's a sample of text you would include in the configuration file:

<Directory "/var/www/html/intranet">
Options Indexes Includes FollowSymLinks
AuthType Basic
AuthName staff
AuthUserFile /var/www/users/staff
AuthGroupFile /var/www/users/groups
Satisfy any
require valid-user
require group staff
Order deny,allow
Order allow,deny
Allow from
Deny from all

A directive like this needs to be put in the correct, general location in the httpd.conf file. Just search for <Directory for the example and place it in that area.

You'll notice that I specify the directory protected in the openning tag (with no trailing slash). I also specify where to find the user file (staff) which contains the user names and their encrypted passwords.

Read the man pages on htpasswd, obviously. But, basically, you create the user file in the directory you want and your first user by typing the following command at the command prompt:

    htpasswd -c staff bob

You'll be prompted to enter the user's password in twice. To add more users to this "staff" file, type:

    htpasswd staff ted

One last comment about my sample configuration: I'm protecting an intranet section of my web site for employees to use from home or work. If they're outside the office, I want them to be authenticated so I can be sure of who it is that's coming in. However, if they're inside my local network, I don't want them to have to worry about authenticating. So I've added the line "Allow from" where my network subnet is 10.1.71.x.

Replies are listed 'Best First'.
Re: Re: cgi and https (mildly off topic)
by IlyaM (Parson) on Nov 27, 2001 at 15:59 UTC
    There is no way how HTTP authentication can be conducted only once and not repeated with each page retrieved. Read RFC for HTTP 1.1. Basic HTTP authorization require user agent to send username and password on each HTTP request for protected area.

      I'm sorry to have taken so long to respond to your comments, IlyaM, but I got side tracked with other activities and I needed time to ponder your comments. I agree with your comments, but to the extent that they contradict mine, I'm now confused.

      What you said makes sense as I understand httpd: After a page is requested from Apache and delivered, the relationship is terminated, the daemon dies along with all references to the client. If this understanding of mine is incorrect, please correct me.

      My error seems to come from my reading of a line in O'Reilly's book, Apache: The Definitive Guide (2nd Edition) by Ben & Peter Laurie. In Chapter 5: Authentication, on page 126, the section entitled, "Using .htaccess Files" it says:

      "The drawback to the .htaccess method is that the files are parsed for each access to the server, rather than just once at startup, so there is a substantial performance penalty."

      Honestly, I think you're right. I must be misreading O'Reilly's book. I know it's not your job to defend O'Reilly, but I'm trying to reconcile the two logical comments. Incidentally, I think this relates to Perl and Perl Monks in that the is very widely used by perl programmers.

      Please let me know what you think.


        To clarify any possible confusion:

        .htaccess does affects perfomance since it is parsed on each request. This is correct. But actually it is not related directly to HTTP authorization. This perfomance hit occurs for any request for file in directory with .htaccess file whenever that directory is protected with HTTP authorization or not.

        HTTP authorization commands can be put both into .htaccess and into main apache config file. In both cases authorization should be conducted on each request because of stateless nature of HTTP protocol.

        I think in most cases having HTTP authorization commands in .htaccess or in main config doesn't affect perfomance so much as proper selection of auth module. Certantly plain text files is much more slower than indexed database for big number of users.

        Ilya Martynov (

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://127747]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others pondering the Monastery: (4)
As of 2017-08-17 19:42 GMT
Find Nodes?
    Voting Booth?
    Who is your favorite scientist and why?

    Results (292 votes). Check out past polls.