Download the PHP package prokki/htpasswd without Composer

Htpasswd

This symfony user provider reads user from the htpasswd file.

To use the a htpasswd file you need to execute following three steps:

1. Run composer to install the bundle,
2. configure your security configuration and
3. create a htpasswd password storage file.

All available password formats of the basic authentication are supported: apr1-md5, bcrypt, crypt, sha1 and plain text - see http://httpd.apache.org/docs/current/misc/password_encryptions.html.

Table of Contents

• Requirements
• Integration & Basic Usage
  • Installation
  • Symfony Configuration
  • Add Htpasswd File
• Advanced Usage & Configuration
  • Change Location of Your Htpasswd File
  • Change Default User Roles
  • User Roles Inside Htpasswd File
• Credits

Requirements

The usage of PHP ≥ v8.0.2 and Symfony ≥ 6 is recommend.

Integration & Basic Usage

Installation

Please install via composer.

The bundle will be automatically added to your bundles.yaml configuration.

Symfony v4, Symfony v5

PHP v7.2 and Symfony 4 is obligatory.

To use an older version of Symfony/PHP please use version 0.*

Symfony Configuration

To enable the functionality you have to change your security configuration manually.

1. Enable the provider HtpasswdUserProvider and the encoder HtpasswdEncoder in your security configuraton, i.e. in your %kernel.project_dir%/config/security.yaml file.
   2. To enable http basic authentication add the http_basic authentication method to the firewall configuration.
   3. Additionally be sure to enable access_control for at least one path.

security.yaml:

Feel free to use the full flexibility of the Symfoniy security layer which means i.e. you can

• chain firewalls,
• add other providers and encoders,
• restrict basic authentication to certain paths only
• etc.

Add Htpasswd File

Create your custom htpasswd file using the htpasswd command in the project directory of your project.

Hint: Usually the command is installed automatically if you run an apache web server, i.e. if you use xampp or your package management system. On linux systems the command is mostly provided by the package apache2-utils.

Create a htpasswd file in your project directory. Call the following command and type in your password:

A new file was created in your project:

:warning: For safety reasons we suggest to not include the htpasswd file in your repository!

Advanced Usage & Configuration

You are not really able to change the configuration of the bundle, but at least you can customize the location of your htpasswd file and the default user roles.

In both cases you have to create a new configuratio file htpasswd.yaml for the bundle:

The default content of the file should look like following. If you just insert these configuration, the bundle works with default settings.

Change Location of Your Htpasswd File

It is possible to change the default location by changing the path variable.

This is useful if you use your htpasswd file in other projects or if you set up a basic authentication additionally via your apache2 configuration.

Change Default User Roles

The default user role assigned to each user (included by the HtpasswdUserProvider) is ROLE_USER. To change the default user roles, adapt the roles variable in the configuration:

If you change the roles config parameter, be sure to include all roles which are necessary. There is no process to add another default user role.

Additionally please take care, that the roles

1. follow the recommendations of symfony user roles and
2. match the access_control settings in your security.yaml file.

User Roles Inside Htpasswd File

The implementation of the basic authentication allows you to add user roles at the end of each line in the htpasswd file.

Similar to overwriting the user roles by configuration, be sure to

1. follow the recommendations of symfony user roles and
2. match the access_control settings in your security.yaml file.

The user roles are a comma-separated list which are separated from the origin line by a colon. Example:

:warning: This feature is probably not supported by all platforms!

Content of a well-structured htpasswd file:

Content of a htpasswd file with additional user roles:

Credits

A big thank you to https://github.com/whitehat101 for the implementation of the apr1-md5 algorithm.