Password-protect a directory, but not that directory's files?

Question

I was just wondering if it was possible to protect a directory with a username/password combination using .htaccess and .htpasswd files, but not protect the files within. i.e. One is able to link, say, images within that directory to friends, but browsing the directory itself would not be allowed without a username/password. Thanks to all in advance.

Answer 1

You want to just turn off displaying Apache the index of the folder. Put this in the .htaccess:

Options -Indexes

This way when Users visit http://www.url.com/folder/, they get a Directory listing denied error. But when they visit http://www.url.com/folder/file.jpg they can see the file.

Answer 2

Do a chmod 777 on the files, but not on the main folder.

Answer 3

If you want the directory listing to be visible to only authroized users but allow anyone to download a file (so you can send people links), then you need a script of some type (PHP, ASP, etc.) which asks the user for a password and if they get it right displays the contents of the directory. You would put this script in the directory and name it as index.php so it gets served rather than apache generating a directory index.

Answer 4

Yes, you can secure files and directories by name or pattern. You should already by using this to restrict access to the .ht* files. Check your apache configuration. The required file pattern will likely be '/$'.

Answer 5

Use LocationMatch to limit the auth stuff to the directory index.

Answer 6

Yes. Add an index.html file that lists the contents of the folder and restrict access to that file with .htaccess. If you want the index to be dynamic you'll need to use some sort of script (or server side include) to generate the index.

Answer 7

Try this in your .htaccess:

Require valid-user

<Files ?*>
    Order allow,deny
    Allow from all
    Satisfy any
</Files>

Here Require valid-user requires any known login. Then you amend this restriction for files with at least one character in their name – this is what the glob pattern ?* for the <Files> section will match –, which effectively means the enclosed rules apply to files, but not to directories.

In the amended rules for files, the key is Satisfy any. It allows the authorization to satisfied by either credentials or IP address. Then you allow any IP address to pass, so requests are always authorised.

So now browsing this directory or any of its subdirectories will require a login, but directly retrieving a file from it won’t.

Which is what you wanted.