Menu
The code below appears to show the text "HELLO WORLD" just fine in Firefox, IE, Safari, but not in Chrome.
<Files wp-login.php>
AuthType basic
AuthName "HELLO WORLD"
AuthBasicProvider file
AuthUserFile /home/.htpasswd
Require valid-user
</Files>
ErrorDocument 401 "Authentication required"
How can I make sure AuthName works in all browsers?
362
We will use the htpasswd utility provided in the core Apache package. The password file can be stored anywhere on your hard drive. In our example we will create our htpasswd file in /etc/htpasswd. Note that the location of the htpasswd file can be anywhere you want on your local drive.
Apache supports one other authentication method: AuthType Digest . This method is implemented by mod_auth_digest and is much more secure. Most recent browsers support Digest authentication.
The htpasswd command will allow us to create a password file that Apache can use to authenticate users. We will create a hidden file for this purpose called . htpasswd within our /etc/apache2 configuration directory. The first time we use this utility, we need to add the -c option to create the specified passwdfile.
The AuthName directive sets the realm parameter in the corresponding header, something like:
WWW-Authenticate: Basic realm="HELLO WORLD"
I found a Chromium ticket from October 2015 that reports a man in the middle attack related to HTTP authentication: Issue 544244 - HTTP basic auth credentials prompt should make the origin stand out more. During the discussion it was pointed out that text in realm can not be trusted and can be used in phishing attacks to trick users into revealing passwords to third-parties. I'm not a security expert but I understand that a proxy can inject headers —and usually does— thus the issue.
Apparent, the realm was removed form the authentication dialogue as a result of this and changes were eventually ported to Chrome. You can see the Do not show untrustworthy strings in the basic auth dialog code review for further details.
128
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
