Hello folks! Here is another blog that will help you to restrict anonymous or unwanted users entry on your web application when it is in development mode on the server. You will be wondering why did I come up with such an idea? And how it will help you out? This is what we will be discussing in this post. Quite a times we ignore to restrict anonymous entries due to some data integrity and that results in spoiling our site.
Let me tell you how?
Recently, one of my friends has started working on his Drupal website from the scratch and he wants to stop the anonymous entries whether it's a new registration or anonymous view or comments as he is working on some serious stuff. Further, he doesn’t want to spoil the site from unknown users. And for this, he decided the restrict web application to an anonymous user. You may also like to check out our previous post where we have explained how to secure user’s private data from unauthorized access by enabling SSL on web server.
Note: It will be open up for generic users, who all are the part of the ongoing development with the help of Authentication Prompt.
Check out some of the ways that will help you to tackle the similar situation:
To restrict registration - Don’t allow anonymous user registration
To restrict login - If you follow first
Anonymous Comment - Turn off comment system
The above-mentioned ways are alternatives to prevent anonymous users from getting access to your site. When you limit access to your website, you need to allow site access only to those users who have correct admin credentials. And they are only allowed to grant the access. This can be accomplished using .htaccess & .htpasswd.
I guess you won’t be surprised of hearing these two names as you might have seen these residing in the root directory of your server.
.htaccess: A configuration file in '.htaccess' is used to run a web server like Apache. When a .htaccess file placed in the root directory of your website, it gets loaded through Apache, and then .htaccess file gets executed by Apache web server.
The .htaccess file is used to alter the configuration, enable or disable additional functionality and features of the Apache web server. Also, these files provide basic redirection, content password protection or image hotlink prevention. This method is called htaccess password protection or htaccess authentication.
Creating a htaccess file
You can create a .htaccess file by entering few lines of code that needs to be read by Apache. Further, to protect the site you need to write code that will be read by Apache before directing from the server to the end users.
AuthUserFile full path of .htpasswd
AuthType Basic
AuthName "write some description here"
Require valid-user
The AuthName parameter defines the title of the password entry box while login. Remember, here, the declaration is important.
The AuthType is a method used to authenticate the user. The common method is Basic, which is implemented by mod_auth_basic. The basic authentication sends credential from browser to server.
AuthUserFile: It is a full path of .htpasswd file.
Require: It provides authorization to set up the user, who is allowed to access the area on the server.
Note: We can give access only to specific users and all other users are supposed to be listed in .htpassword.
Only to specific user
require user
Below-mentioned source codes are from my local .htaccess that allows access to specific users
AuthUserFile C:\xampp\htdocs\.htpasswd
AuthType Basic
AuthName "My Secret Folder"
require user xaiwant
All user listed in .htpasswd
require valid-user parameter in .htacess for all user access.
Following source codes are from my local .htpassword that give access to all users.
xaiwant:$apr1$zx523D3t$VXU..vXqErSd1wOlSI9k41
want:$apr1$d7eWG8M.$PVnGYLZwuuzIXRXNxQ4Be0
With a password, the .htaccess file can protect your website, including all files in the folder and sub-folder too. Not to mention if you want to protect your website from unauthorized access, you have to place a .htaccess file in root folder.
AuthUserFile C:\xampp\htdocs.htpasswd\.htpasswd
AuthType Basic
AuthName "Drupal 7 Instance"
Require user xaiwant
.htpasswd: htpasswd file is used to store usernames and password for basic authentication of HTTP users. This file is called as Apache htpasswd aka Apache password file.
In case you find any difficulty while login to the prompt, then it must be htpasswd access issue (Read/Write) due to permission and same is likely to throw an error.
Resources available from Apache can be restricted to users by using the files created by htpasswd. Files managed by htpasswd may contain a mixture of different encoding types of passwords.
Creating a password file
Create a text file that store username and password separated by colon [:]. The password should be in encrypted form, which means you can utilize online web tools to generate them. Here I am sharing one of the URLs.
http://www.htaccesstools.com/htpasswd-generator/
Below is the encrypted credential of one of my local instance:
xaiwant:$apr1$zx523D3t$VXU..vXqErSd1wOlSI9k41
Copy and paste your encrypted credentials and then save the file. Place the folder out of your directory so that nobody can view the file.
Similarly, you can also create a file name with your choice like xyz. It’s always suggested to change the filename so that it can’t be guessed by Hackers. FYI, Apache provides better file security in terms of web-based access to those files which starts with .ht.
Still, if you want to know more then please visit http://www.apache.org/ or Google it for more valuable and authentic information.
To add password protection, you need to:
Create a txt file .htpasswd on your server, which will store your username and password.
Create a special file, called .htaccess, in the folder you want to protect.
That's it! Now let's take a look at how to do each step.
Note: Don’t forget to Restart your server after making all the required changes.
Now hit the URL in the browser and you will get a prompt box asking for username and password. Enter the corrected credential and you are in.
Note: You can access the folder n number of times on the server or on the local machine till your browser is open. Once you restart the browser, you will be asked for login credentials again with prompt box.
In case you haven’t been asked for credential then you need to check whether:
- File path is correct or not.
- File is accessible or not. Related to permission.
- Entered credentials are correct or not.
There you have it! I guess this is the easiest and simplest way to set up the restriction on Drupal website that is running on Apache server. By using “.htaccess” and “.htpasswd”, you can easily limit your site from anonymous entries whether it’s a new registration or anonymous view or comments.
The goal of our blog is to bring you valuable information to help you grow your business. We hope you enjoy this post! We invite you to comment below or ask any questions you may have.
