: How to avoid basic authentication warning when using protected directory? I used cpanel on my hosted site to set up a password protected directory to allow downloads of specific files. I send

@Sims2060225

Either use SSL or switch to digest authentication. HTTP has supported digest authentication since HTTP 1.1, and pretty much all contemporary browsers (hopefully by now even lynx has added HTTP digest) support digest authentication. It's no more difficult to implement or any more taxing on the server or client, so there's really no more reason to continue using basic authentication.

It's sad that cPanel and so many other web hosts' control panels still default to basic authentication for whatever reason, but most cases (one of my few gripes with DreamHost is that they still default to basic authentication for SVN repos, and there's currently no way to change it manually) you can easily set up digest authentication on your own.

You just need to use htdigest to generate a password file and change the .htaccess configurations to:

AuthType Digest
AuthDigestDomain /private/
AuthDigestFile /path/to/.password_file


All the other HTTP authentication directives remain the same.

Vote Up Vote Down

@Sarah324

Yes, SSL is the answer. Without it their login and password are sent in plain text which is insecure. SSL encrypts their login information so it is secure from eavesdroppers.

Vote Up Vote Down

@Turnbaugh106

This username and password are being sent in plain text over the network connection so it's vulnerable to packet sniffers like wireshark. As the wiki says:-


Although the scheme is easily implemented, it relies on the assumption
that the connection between the client and server computers is secure
and can be trusted. Specifically, if SSL/TLS is not used, then the
credentials are passed as plaintext and could be intercepted.


So you would have to use some form of of SSL to prevent the warning from appearing.

All that said, for very basic security I use a program called Coffee Cup Website Access Manager which generates .htpaswrd files and and uploads them to a webserver and I've never experienced (or had a client experience) a security warning like the one you refer to.

Vote Up Vote Down