Hi, Drupal runs on FastCGI at my provider. And it is running in a sub-directory "drupal/"

One of those setups are the reason that the APP can only log in with the htaccess modification option#2 you provided, which you called less secure.

Security is a big concern. So what is this htaccess hack#2 doing? Making my login data visible?

Is there anything I can do to get security back? Login with https maybe?

Comments

jchatard’s picture

jchatard commented
Status: Active » Fixed

Hi ceberlin,

In snippet #2, your credentials are combined and encoded in base 64.

I consider this being less secure because it may be possible that a PHP script could dump, show or expose the login $_GET parameter that snippet #2 creates.

But this shouldn't be a concern, since I can imagine that you manage the files on the server.

Does this answer your question?

Thanks,
Jérémy

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.