Interesting htaccess problem

[Stephen]

I've tried endless tutorials and pored over the Apache docs and have still not found a workable solution to my problem, so let me ask you good folks for an opinion.

I have a 'secure' area (htaccess/htpasswd). I want folks entering it from a certain domain to completely bypass the standard login prompt, so in effect, you have two classes of visitor - the ones who don't need to enter a user/pass combo, and everyone else. This is the code I'm using, but it doesn't work, in that folks coming from "domain.com" are still hit with the login box, despite the "allow from" and "satisfy any" lines.

Sure, I'm uploading in ASCII and all that - this isn't the first time I've used .htaccess - just the first time I couldn't get it to work...

Any ideas?

AuthUserFile /usr/home/docs/.htpasswd
AuthGroupFile /dev/null
AuthName "Restricted"
AuthType Basic

order deny,allow
deny from all
allow from .domain.com
require valid-user
satisfy any

Thanks!

[Fuckin Bill]

Are you trying to allow people being referred from a certain domain to come in freely? Or you're trying to allow people who are ON a certain domain to come in freely?

I think you might be confusing what the allow/deny stuff does. The allow statement will let people in who are ON a certain domain. So if you're on a network called net.com, allow net.com will let you in. But if you are on a network called org.com and get referred from a page on net.com, you will be asked for a password.

It's not looking at referrers to see who gets it with a free pass, it's looking at what network the accessing computer is a part of.

Also, if you don't have reverse DNS lookups turned on in apache, it won't know the hostname anyway, you'll have to use IP addresses to let certain people in. Turning on reverse DNS will most likely slow the server to a near stop.

[Stephen]

Are you trying to allow people being referred from a certain domain to come in freely? Or you're trying to allow people who are ON a certain domain to come in freely?

I think you might be confusing what the allow/deny stuff does.

Being as technical as a grapefruit, I'm sure I'm confused about what's happening

What I'm specifically trying to do is to pop an exit off my join page that allows surfers the option of joining through an AVS: "You didn't like that offer, what about this one?"

Since the AVS handles authentication on their end, they are not writing u/p info to my htpasswd file, simply sending valid users to a specified URL, where they are now being hit with my login box. I don't want them seeing this box, just having member access.

Folks who signed up through CCBill will use the login box.

So, it's "allow these folks in" - but ask these other guys for their user/pass that I'm after

[sinnerscorner]

You can try this.


Satisfy Any
AuthType Basic
AuthName "Members Area"
AuthUserFile /thepath/onyourservertoyour/.htpasswd
AuthGroupFile /dev/null
<Limit GET POST>
require valid-user
order deny,allow
deny from all
allow from 111.222.333.444
</Limit>


Replace /thepath etcetera with the path on your server
to the members area .htpasswd file
and replace 111.222.333.444 with the ip of the AVS site
the users with no password will be coming from as far
as I know some AVS sites have instructions on how to
setup this part properly.

[Fletch XXX]

htaccess can be a bitch sometimes.

i had some issues lately with a forum hotlinking a site of mine.

htacess can save lots of bandwidth