Hey all, I just put a new MODx site online today, but we’re having an issue with our password protected directories now, which I think the MODx .htaccess file is causing. Every password protected directory (subdirectories of the modx directory) now show the MODx 404 resource. for example, I have my manager directory password protected to add an extra layer of security against snoopers. This no longer works, and instead shows the 404 page. Removing HTTP Authentication fixes the issue, but that isn’t really a solution.
Does anyone have any ideas?
EDIT: Figured it out - I feel silly now.
For anyone that runs into a similar issue, I fixed it by creating a custom 401 HTML page and placing it outside the protected directories. then I added the ErrorDocument directive to each protected directory’s .htaccess file referencing the new 401 document. Worked like a charm!
Apparently when Apache sees that a directory has an .htaccess file requiring authentication, and no 401 document exists, it skips over the rules in the file and instead inherits the parent’s .htaccess rules - defaulting to mod_rewrite, and resulting in a 404.
I hope this helps someone!
