The documentation (althttpd.md) says:
If a file named "-auth" appears anywhere within the content hierarchy, then all sibling files and all files in lower-level directories require HTTP basic authentication, as defined by the content of the "-auth" file.
(Emphasis added by me.)
Is this really true?
I'm running althttpd via xinetd.
service https
{
port = 443
flags = IPv4
socket_type = stream
wait = no
user = root
server = /usr/local/bin/althttpd
server_args = -logfile /var/log/althttpd.log -root /home/user/srv -user www-data -cert /etc/acme.sh/static/cert.pem -pkey /etc/acme.sh/static/key.pem
bind = xx.xx.xx.xx
}
I have added a -auth file (including a user name and a password) to ~/srv/default.website/. When I surf to https://example.com/index.html, I'm asked for my credentials. https://example.com/m/index.html works without authentication. (Same when I change the password and try the subdirectory first. So it's not about saving the credentials in the browser.)
I'm wondering if this is a bug or just a wrong/outdated documentation because in althttpd.c, the comment says:
If the file "-auth" exists in the same directory as the content file ...
No subdirectories mentioned!
Minimal example for reproducing this issue:
wget -O althttpd.c "https://sqlite.org/althttpd/raw/077ca4231caec28d5a3830ed3aefb27e74666837d464c2b3934bd09c1b8dbe42?at=althttpd.c"
sudo gcc -Os -o /usr/bin/althttpd althttpd.c
cd /tmp
mkdir -p default.website/subdir
echo secret > default.website/index.html
echo "also secret" > default.website/subdir/index.html
echo "realm My secret webspace
user john john:passwd" > default.website/-auth
althttpd -root /tmp/ -port 7000
Browse to localhost:7000/subdir → Secret file is accessible.
Browse to localhost:7000 → You will be asked for credentials.
The following patch is released into the public domain:
@@ -3103,13 +3343,24 @@
/* Check to see if there is an authorization file. If there is,
** process it.
*/
sprintf(zLine, "%s/-auth", zDir);
- if( access(zLine,R_OK)==0 && !CheckBasicAuthorization(zLine) ){
- tls_close_conn();
- return;
+ for( ;; ){
+ if( access(zLine,R_OK)==0 ){
+ if( !CheckBasicAuthorization(zLine) ){
+ tls_close_conn();
+ return;
+ }else break;
+ }else{
+ char *ptr=zLine+strlen(zLine)-1;
+ for( ; ptr!=zLine && *ptr!='/'; --ptr );
+ if( ptr==zLine ) break;
+ for( --ptr; ptr!=zLine && *ptr!='/'; --ptr );
+ if( ptr==zLine ) break;
+ strcpy(ptr+1, "-auth");
+ }
}