Disable Basic Auth for iframes

Question

Here is what I am dealing with. I have the following in httpd.conf file. This forces authentication on 127.0.0.1/example as intended.

<Location /example/>
   AuthType Basic
   AuthName ...
   AuthUser File ...
   Require valid-user
</Location>

I also have a php file as follows (http://127.0.0.1/pre2.php)

<?php if(isMember()=='access'){?>
<iframe src="http://127.0.0.1/example" style="border: none; width:100%; height:1100px;"></iframe>
<?php
}?>

I need to make sure authentication doesn't get called by apache when 127.0.0.1/example is accessed via iframe in pre2.php.

Take a look here [htaccess exclude one url from Basic Auth][1] [1]: http://stackoverflow.com/questions/8978080/htaccess-exclude-one-url-from-basic-auth — Imperialized, Sep 27 '15 at 23:35
The problem is the request starts with the same path. Doesn't it? — Sam Kingston, Sep 27 '15 at 23:38

score 2 · Answer 1 · answered Sep 28 '15 at 00:20

2

Unless you can pass some authentication information to the /example request, there's not going to be a way to do this without someone being able to circumvent authentication. You can't check the Referer header because that can be forged.

What you're better off doing, is in your pre2.php script, instead of linking to the /example content via an iframe, can you just read the content and insert it.

answered Sep 28 '15 at 00:20

Jon Lin

142,182
29
220
220

I can't do that because the file is an executable that needs to be visited. Is there any way to wrap the url in something other than iframe then write a rule to satisfy all? Or, to autofill the authentication dialog using master username and password without revealing to general public? – Sam Kingston Sep 28 '15 at 01:13

score 0 · Answer 2 · answered Sep 27 '15 at 23:52

0

For some reason it won't let me add a comment under yours. But I misunderstood your question I think. Yeah, I suppose that you are correct. What about doing an include on the file? Does that get around it?

answered Sep 27 '15 at 23:52

Imperialized

443
1
4
13

I believe not, because the url would still be the same for the iframe. – Sam Kingston Sep 27 '15 at 23:57
I meant just including it the file directly (not into an iframe). Being server side it may bypass the authetication – Imperialized Sep 28 '15 at 00:22
I'll go ahead and give it a try. Thanks. – Sam Kingston Sep 28 '15 at 00:22
No luck with that, since the file need to be visited as it is an executable. – Sam Kingston Sep 28 '15 at 00:50
executable as in .exe file? – Imperialized Sep 29 '15 at 00:31
It is a shiny application. – Sam Kingston Sep 29 '15 at 00:33

Disable Basic Auth for iframes

2 Answers2