This almost sounds like it might be a bug or feature of IE.

When you use Apache directives that have a directory or .htaccess context,
those directives apply for the ENTIRE directory tree from the specified point
recursively down.  So accesses to /www/priv_a/sub_a and sub_b will be protected
by the same passwords in this case.

I don't claim to know the gory details behind HTTP Basic Authentication, but
I'm surprised that IE isn't caching the user/password from the first top-level
directory and automatically (and silently) supplying it when accessing the
subdirectories.

- Mark B.

"Michael P. Smith" wrote:
>
> Have been playing with Apache for a while now and one "feature" is annoying
> to my users (which are all using IE 5.0 or higher).   I have opted to go
> with the mod_auth basic authentication.  The users are getting prompted for
> a password for every directory they enter that is located at or below a
> directory that has a password specified.  To better explain, here an
> example of what I'm talking about.
>
> Assume a basic www structure as follows
>
> /www
>  /pub_a
>  /pub_b
>  /priv_a
>   /sub_a
>   /sub_b
>
> The access.conf section of my httpd.conf file have passwords associated
> with the directory /www/priv_a.  If the users follow a link into a html
> page in /www/priv_a they are prompted for a user/password pair the first
> time and no user/password prompt afterwards (until IE is restarted).  They
> can access all the various HTML pages without additional prompts.  However,
> if they then follow a link from there to an html page in /www/priv_a/sub_a
> they are prompted again, the same for /www/priv_a/sub_b.  Since neither one
> of these directories have a user/password pair associated with them they
> are basically being prompted again for the user/password pair
> for /www/priv_a directory.  Again, once the valid user/password pair is
> entered the user isn't prompted for the user/password pair again unless IE
> is restarted.
>
> In the above example, is there a way of keeping the users from being
> prompted for user/password when they enter the /www/priv_a/sub_a
> and /www/priv_a/sub_b directories after validating by entering
> the /www/priv_a directory?
>
> Thanks
>
> Michael P. Smith
>
> * To join/leave the list, search archives, change list settings, *
> * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *

--
[log in to unmask]
Remainder of .sig suppressed to conserve scarce California electrons...

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *