Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Are there any known flaws with htaccess protected pages?
I know they are acceptable to brute force attacks as there is no limit to the amount of times someone can attempt to login. And if a user can uploaded and execute a file on the server, all bets are off…
Are there any other .htaccess flaws?
.htaccess is just a means of specifying Apache configuration directives on a per-directory basis. They allow numerous different kinds of password protection.
If you are talking about HTTP Basic Authentication then the username and password are sent in cleartext with every request and are subject to sniffing (assuming you aren’t using SSL).
Aside from that, they are subject to the usual issues that any password based system suffers from.
Using HTTP Basic Authentication doesn’t grant any additional ability for users to upload and execute files. If they can do that already, then they can still do that. If they couldn’t, they can’t.