CakePHP + admin routes + .htaccess + production mode

Question

Hi all!

The following site shows a (kinda hack-ish) way to protect an admin route with .htaccess:

http://snook.ca/archives/servers/password%5Fprotect%5Fadmin/

If I understand it correctly, it only works because CakePHP runs a check for the 'real' file presence before it processes its own URL logic. So, when you request yoursite.com/admin, it checks for the default document in the (real, since we've created it) /admin dir, and this check triggers the authentication.

My issue is: the 'hack' works OK if I set my debug level to '1' or higher. If I set it to Production Mode ('0'), I just get a cake-interpreted HTTP 401 (Access Denied) error.

So, my question is: is there any way to make this 'hack' work with the debug level set to zero?

Answer 1

Check out the SecurityComponent which lets you set up basic HTTP Authentication with a few lines of code in your beforeFilter. Should be a lot more robust than this hack.

---

I do agree though that the AuthComponent is terrifically easy to set up. You just copy and paste the snippets for the UserController and login form, run the table creation script, try to log in, take the encoded password from the SQL log, put it in the database and add Auth to the component list in your controller. Takes less than 3 minutes and makes a better impression to the client (in case anybody cares ;)).

Answer 2

I didn't know how to add this as a comment to the original question, but I have a case where I am using Auth for my app, but still need .htpasswd to work for AwStats which is in the root of my hosting account along with my CakePHP Application.

My issue is exactly how the OP describes whereby if I set debug to 1 everything works fine, but if I set it to 0 for production I get Error 401 when I try to access /awstats.

So can anyone throw some light on what Cake is doing different with the request when debug is 0 compared to when it is set to 0?

Thanks,

Paul.