Home/ Questions/Q 6895523
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T06:55:09+00:00

I am using flatfile databases (have to) and am putting an apache basic_auth on

  • 0

I am using flatfile databases (have to) and am putting an apache basic_auth on the folder which I will then access via PHP’s fopen() with the username and password contained within the url, e.g:

fopen("http://username:password@domain.com/protectedDir/file.txt","r");

I am just wondering how safe this is in terms of prying eyes, as I know POST and any other requests can be snooped on by the user but will the user be able to see the url that fopen() requested to?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The URL is not visible to the user by default. However, it may show up in an error message, for example when domain.com is temporarily unreachable. Disable showing of errors to the user.

    Secondly, it would be advisable to use HTTPS to send the username and password encrypted over the network, instead of in plaintext.

    Edit: PHP hides username and password in the error message:

    PHP Warning: fopen(http://…@domain.com/protectedDir/file.txt):
    failed to open stream: HTTP request failed! HTTP/1.0 404 Not Found

    • 0