Watch / Monitor Sites hidden from Public (behind .htaccess)

[jamfx]

Hi Nicholas,
I would love to have the ability to watch sites which are under Construction an protected behind .htaccess (even the Frontend). The reason is, that sometimes I start developing Sites on my Playground which is online on my server, but - as mentioned - hidden behind a .htaccess Protection.
Is this on the roadmap or already included and I missed it?
Best regards
Niko

[nikosdion]

Remember, this is a server feature. It cannot be implemented in client software. It's your server, your server config, you get to configure your server to allow access to the api folder 😉

You can definitely allow the api directory – more precisely, every URL whose path starts with api/ – to be directly accessible, without it being challenged by a password. Take a look at how Admin Tools' Administrator Password Protection feature does it when you tell it to only protect .php files to get an idea of the .htaccess syntax.

[jamfx]

Hm, I can give credentials for the /administrator-Folder, but I can not give credentials for the frontend? Okay. 🤷

[nikosdion]

You are not phrasing this correctly.

You can give me login credentials to the administrator/components/com_joomlaupdate/extract.php because these login credentials will only be consumed by your server's HTTP Basic Authentication module to allow access to that file. Accessing this file's features is enabled by a password given in the POST data of the request, a password we have generated and retrieved with a previous call to the Joomla! API.

You can NOT give me login credentials to the Joomla! API application folder, i.e. the api/index.php file, because the HTTP Basic Authentication will be consumed by BOTH your we server's HTTP Basic Authentication module AND Joomla's Basic Authentication module. The former will allow you to access index.php. The latter, however, will override the API Token when doing API authentication. Since your username and password do not match a Joomla! user you will get a login error to the API application and nothing will work.

The fact that you didn't know about this problem – despite building sites with this CMS since it was called Mambo – is exactly why I can't offer the feature you requested. Everyone except a developer would see an API authentication error and would wonder WTF is going on when all the information they have entered is correct as far as they can tell.

[jamfx]

Thanks for your explanation. I think I got a deeper insight now.

[laoneo]

I had the same problem, so I did adapt my htaccess a bit by allowing api and extract.php. This should only be used temporary as it doesn't protect api and extract.php anymore with basic auth.

AuthType Basic
AuthName "Protected Area"
AuthUserFile /var/www/html/.htpasswd
Require valid-user

SetEnvIf Request_URI "^/api/*" allow
SetEnvIf Request_URI "^/administrator/components/com_joomlaupdate/extract.php" allow
Order allow,deny
Allow from env=allow
Satisfy any

[jamfx]

Thanks for your help. I used this part:
SetEnvIf Request_URI "^/api/*" allow SetEnvIf Request_URI "^/administrator/components/com_joomlaupdate/extract.php" allow Order allow,deny Allow from env=allow Satisfy any
And Panopticon could connect. Thanks @laoneo ❤️