Search code examples
security.htaccessauthenticationpasswords

How secure is htaccess authentication

I need to protect a clients CMS with a username and password, only one username is needed. I was going to use htaccess because its so quick to add.

I'll be adding it using the password directories feature in WHM which stores the passwords here: AuthUserFile "/home/username/.htpasswds/public_html/cms/passwd"

How secure is this? Are there ways to get into folders such as .htpasswds?

Solution

  • Straight from Apache's documentation

    The most common method is Basic, and this is the method implemented by mod_auth_basic. It is important to be aware, however, that Basic authentication sends the password from the client to the server unencrypted. This method should therefore not be used for highly sensitive data, unless accompanied by mod_ssl. Apache supports one other authentication method: AuthType Digest. This method is implemented by mod_auth_digest and is much more secure. Most recent browsers support Digest authentication.

    Please read the rest HERE

    Please read the comments, things have changed since 2011. Good catch @reve_etrange