I have a problem with .htaccess in that I reach the 401 authentication required, and I receive the associated browser prompt. However if I click cancel in the browser, the site continues to load (but only loads content from external domains). i.e. what I am seeing is as follows :

  1. I visit http://staging.mywebsite.example.com
  2. The browser displays the password prompt, I hit cancel
  3. External content renders content in the screen, i.e. if I look in Firebug, I can see content being loaded from external domains, i.e. http://mywebsite.example.com (i.e. not the staging site), and various bits of external content, i.e. Google Analytics etc.

I am running the following (cPanel on CloudLinux):

  • CloudLinux release 7.2
  • Apache/2.4.18
  • Linux 3.10.0-427.10.1.lve1.4.7.el7.x86_64 #1 SMP Sat Apr 2 12:09:46 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux

My .htaccess looks as follows :

AuthType Basic
AuthName “Hello world ! “
AuthUserFile "/home/base/.htpasswds/public_html/passwd"
require valid-user
IndexIgnore *
Options +FollowSymlinks
Options -Indexes
RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule .* index.php [F]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteCond %{REQUEST_URI} !^/index\.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php [L]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.