Symfony2 simple .htaccess password protect for dev

Question

I would like to use a .htaccess file to protect my symfony2 website while developing it.

I added the following line at the beginning of my .htaccess located in /web and a .htpasswd file just next with my password.

AuthName "Développement"
AuthType Basic
AuthUserFile ".htpasswd"
Require valid-user

I have a Error 500 when I try to access my website. Is it possible to use a htaccess in my case ? What should I use if it is not posible ?

Answer 1

Assuming the 500 error is caused by these directives, the most likely reason is the path to .htpasswd. AuthUserFile says

The AuthUserFile directive sets the name of a textual file containing the list of users and passwords for user authentication. File-path is the path to the user file. If it is not absolute, it is treated as relative to the ServerRoot.

So either use an absolute path (e.g. /var/www/.htpasswd) or add the complete path starting from your document root (e.g. web/.htpasswd).

---

Also note the last section in AuthUserFile

Security
Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.

This means, store the auth file somewhere else, like /etc/apache2/htpasswd.