Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was just wondering if it was possible to protect a directory with a username/password combination using .htaccess and .htpasswd files, but not protect the files within. i.e. One is able to link, say, images within that directory to friends, but browsing the directory itself would not be allowed without a username/password. Thanks to all in advance.

share|improve this question

Try this in your .htaccess:

Require valid-user

<Files ?*>
    Order allow,deny
    Allow from all
    Satisfy any

Here Require valid-user requires any known login. Then you amend this restriction for files with at least one character in their name – this is what the glob pattern ?* for the <Files> section will match –, which effectively means the enclosed rules apply to files, but not to directories.

In the amended rules for files, the key is Satisfy any. It allows the authorization to satisfied by either credentials or IP address. Then you allow any IP address to pass, so requests are always authorised.

So now browsing this directory or any of its subdirectories will require a login, but directly retrieving a file from it won’t.

Which is what you wanted.

share|improve this answer

Yes, you can secure files and directories by name or pattern. You should already by using this to restrict access to the .ht* files. Check your apache configuration. The required file pattern will likely be '/$'.

share|improve this answer

Use LocationMatch to limit the auth stuff to the directory index.

share|improve this answer
<LocationMatch "/pictures"> AuthUserFile /home/asdasd/public_html/user5678/pictures/.htpasswd AuthGroupFile /dev/null AuthName "Restricted Directory" AuthType Basic </LocationMatch> <Limit GET POST> require valid-user </Limit> This is my current .htaccess file, located in /pictures. Is there something I'm doing wrong? This seems to return a 500 Internal Server Error. – user38597 May 29 '10 at 10:29
a) read about LocationMatch, it requires a regex. b) You need to put the require valid-user inside the LocationMatch block of course (why the Limit statement anyway?) – Marian May 29 '10 at 14:34

You want to just turn off displaying Apache the index of the folder. Put this in the .htaccess:

Options -Indexes

This way when Users visit, they get a Directory listing denied error. But when they visit they can see the file.

share|improve this answer
This is not was was asked, this disable listings, not password protects them – ChanibaL Apr 15 at 15:57

If you want the directory listing to be visible to only authroized users but allow anyone to download a file (so you can send people links), then you need a script of some type (PHP, ASP, etc.) which asks the user for a password and if they get it right displays the contents of the directory. You would put this script in the directory and name it as index.php so it gets served rather than apache generating a directory index.

share|improve this answer

Yes. Add an index.html file that lists the contents of the folder and restrict access to that file with .htaccess. If you want the index to be dynamic you'll need to use some sort of script (or server side include) to generate the index.

share|improve this answer

Do a chmod 777 on the files, but not on the main folder.

share|improve this answer
No​, not this​. – Ignacio Vazquez-Abrams May 29 '10 at 4:54

You must log in to answer this question.