Usernames on CGI server

[#1]

Hi.
Plusnet support tell me you can use .htaccess protection on the cgi servers but I can't get it to work.
My setup is as follows. Pages are still displayed but with no password prompt?
http://ccgi.robsbots.co.uk/cgi-bin/archi/admin/admin.cgi
is the page in question.

Details of server config:-
pwd output of dir to be protected.
----------------------------------
/files/home3/robertl/cgi-bin/archi/admin
Files in directory.
-------------------
.htaccess CHMOD 744
.htpasswd CHMOD 744
admin.cgi CHMOD 755
File .htaccess
--------------
AuthUserFile /files/home3/robertl/cgi-bin/archi/admin/.htpasswd
AuthName "Please Log On"
AuthType Basic
require valid-user
File .htpasswd
--------------
user:xXA9mt4Afp9N6
Access details
--------------
Username : user
Password : password
Any ideas why this is not working ?
Thanks
Robert Last

[#2]

Hi Robert,
As far as I'm aware, .htaccess isn't fully supported on the CGI platform. Here's an excerpt from a response we gave to the Usergroup when this was raised as an issue a while back:

Quote

The way PHP is setup on the CCGI server is as a separate process and not as an apache module. This means apache cannot protect access to .php files using .htaccess because it no longer controls access to such files. Because no php file is found, apache is just protecting the directory as if that was all that was specified. When a php file is found, it is processed by the external php application before any .htaccess protection is checked for. AFAIK, it is possible to enforce .htaccess permissions on non-PHP files.

We're currently looking into the hosting solutions we offer. In the interim, you might want to take a look at our sister company PAYH.

[#3]

As well as it not protecting .php files, you cannot use it within the cgi-bin directory.

[#4]

Thanks for your replies.
Does this mean there is no way to password protect any cgi files.
I want to add some admin cgi files to a site.
Only the owner of the site should have access to them.
Not genreal users.
Is there no way of doing this ?

                  Thanks for your help
                                          Rob

[#5]

I do this type of thing (not on Plusnets servers), by setting a session variable when the user logs in, and then on each page I check if the session variable is set.  If so the page continues, if not they get the login box.
Phil