[Bug / Issue] Password protected vbulletin folder via .htaccess requires two correct logins / entries of username and password to get in

[Maltair]

Has anyone created a password protected folder to keep people out of his vbulletin forum, for example, for a test forum? I mean completely out of the folder that has the vbulletin forum in it.

What I am finding is that for such a situation where I use .htaccess such as with this sort of code:

AuthType Basic
AuthName "forums"
require valid-user
AuthUserFile "/home/________/.htpasswds/public_html/_______.com/forums/passwd"

that anytime someone goes to the password protected directory he has to make two correct and complete entries of the username and PW to get in, which is annoying to say the least. The first entry just results in the Authentication Required prompt popping up again. Have tried it on different browsers, and had others try it, and even Godaddy and Hostgator where I have created these PW protected folders has noted the same issue. They say that is has something to do with that the first pass enters the folder, and then the second pass opens up the vbulletin software with its working CSS. That if this were just a plain Jane html website inside the forum that this would not be happening.

[Wayne Luke]

Most likely caused by the redirects. Solutions would be to use the Two Factor Authentication added for Administrators and Moderators or to restrict access to the AdminCP and ModCP by IP Address using the settings in /core/includes/config.php.

https://www.vbulletin.com/forum/arti...authentication
https://www.vbulletin.com/forum/foru...-now-available

I suspect the /AdminCP directory will be removed from new installs in the future. It is currently empty on new installations and isn't really needed anymore. The ModCP will also be removed when it is no longer needed in the future.

[Maltair]

I want to block access to the forum period to anyone who does not have a username and PW, which is why I am PW protecting the entire forums folder.

[Wayne Luke]

The only thing I can suggest is to deny access via permissions to all usergroups except the ones that should have access.

[Joshua Gonzales]

Forgive me if I am just contributing something you already know or is useless, but I made a private installation using htaccess a while back and used what was in our manual at http://www.vbulletin.com/docs/html/upgrade_testsite

It talks about htaccess at Step 3 - Files

[Maltair]

Right: "You will need to protect this directory from the general public. The most common way to do this is by a combination of .htaccess and .htpasswd files." ---- as noted I have done that. The issue is that for some reason this method creates a need for having to input the username / PW twice to gain entry.

[glennrocksvb]

I think the second one is triggered by one of the resources/requests on the page. Open the Network tab in the browser dev tools to see the requests. When the second prompt appears, check what the last request is.

[Maltair]

When the second pull down Authentication Required window appears (or the first, for that matter), you have not yet "landed" on the page so there isn't a way that I am aware to view or access anything from the page.

You go to the URL that corresponds to the PW protected directory, get this, and enter the correct username and password:



Then, even though you have entered the correct username and PW, you get this second almost, but not quite identical request:




and then after submitting the correct, same username and password this second time, it lets you in. It just doesn't want to let you in on the first correct entry of username and password.


ALSO, if you enter the correct username and PW the FIRST time (only first time), and then enter NOTHING the second round, and just keep hitting Cancel, eventually you wind up in the forum, somewhat, without the CSS in play, and it looks like this:





Now, if you enter nothing at all, EVER (not first, not ever) and click cancel then you'll just end up here:

[glennrocksvb]

Open the dev tools (F12) and then click Network tab before loading the page. If Firefox doesn't allow you to do that, then use Chrome

[glennrocksvb]

My guess is the second time is authentication for the CSS URL requests based on what you said that the layout is broken when not entering on the second prompt

[Maltair]

With Chrome I am able to access Developer Tools, but can't click within it to access Network.


As long as that Authorization Required window remains up the browser is more or less locked from doing much other than entering the username or password into that window.

However once I enter some data and get as far as the lacking CSS version of the website (by entering correct username/password into first window, and then just hitting cancel on the second), I see this:

[glennrocksvb]

I was right. The second prompt is for the css. You can see 401 unauthorized error code for css.php requests

[glennrocksvb]

Actually not just for css but I think for all subdirectories.

[Maltair]

Well, given that there is nothing in the directory (folder) but vbulletin, how best to PW protect the entire folder then without this twice entry of username/password?

[BirdOPrey5]

Are you choosing to save the password? I've done this many times, including for VB 5.x but I always choose to save the password to the browser.

[Maltair]

This issue - having to enter the password twice, isn't so much an issue for me today, but I want to use this PW protection feature for a live forum elsewhere and in that case if every newbie who goes to the PW protected forum has to enter the PW twice, will be discouraged from even trying to enter.

[BirdOPrey5]

This issue - having to enter the password twice, isn't so much an issue for me today, but I want to use this PW protection feature for a live forum elsewhere and in that case if every newbie who goes to the PW protected forum has to enter the PW twice, will be discouraged from even trying to enter.

So is that mean you're net having the browser save the password?