.htaccess-style secure area with modx??

On my current website I use .htaccess to secure a section (directory) of my website. This uses one username and password which all users can use to access this section and its sub-directories/pages. Multiple users can access this section at once even though it has only one username.

So really, its a generic, easy to maintain security option for a section of my website.

My question is, how do I achieve this in modx??

Why not have a look into Web Users/Groups?

http://modxcms.com/why-web-users-and-web-groups.html

Using these will give you far more flexible control over your users and access than .htaccess.

Yes but I don’t particularly want the maintenance of individual users - I just want a generic username/password for all users so they can access a secure area.

I guess that you can’t use the web user method for this because multiple users would be sharing the same session and that would cause problems when they sign in/out. It seems to me that there are at least two ways to do this:

• Create a snippet that checks the username and password entered and sets a session variable if they are correct (you could use eForm and an event function to do this). Then create another snippet that forwards users to the login page if the session variable is not set properly and put that snippet on all your private pages (or you could use a plugin that checks both the session variable and the parent of the document being requested). You’d also want a simple logout snippet that destroys the session.
• Just keep on using .htaccess. Check out this example for one method (you would probably need to include the rest of the MODx .htaccess file to make the rewrite rules work). I believe that you can also require a password for URLs with specific text in them (for example, a virtual subdirectory) and allow access to the rest, but I don’t have an example of that handy.

The latter is probably easier to do, but the former would allow you to use a custom login/out page and do it all within MODx.

I don’t think this is a problem; every visitor gets a different session file with a unique session ID. When you log in, your session gets loaded up with the appropriate values. When you log out, those values are cleared. This has no effect on someone else’s session.

I created a page in my site for testing this, all it does is echo the session name, the session ID, and dump the SESSION itself. I can log in and view the session, then log in from another browser and view that session. Logging in or out does not effect the other browser’s session.

I’ve created this sort of secured area for a number of sites, and never had any problems with it.

Check it out on my site, http://www.sottwell.com/article-sessions.html and use test - testing for the username/password. You’ll get a new menu item, "Now You See Me". Then try it with a different browser, or a different computer.

Am I missing something fundamental here?

Nope. It sounds to me like as usual you’ve hit the nail right on the head, especially since you’ve tested this out whereas I just assumed that I understood how it worked. That’ll teach me not to ass|u|me...

Sotwell - yes you seem to have this system working. Could you tell me, is this simply a case of setting up a standard web user, in this case ’test’ .... or is there more config required around this?!

You could always use HTTP 401 Unauthorized and WWW Authentication Realm header information. I’m currently working on a snippet to handle such functionality...

http://us.php.net/manual/en/features.http-auth.php

I created a web user group, "testing", and a document group, also "testing", then attached the document group to the web user group in the third tab. (Security -> Web Permissions). Then I created a user, test, and assigned him to the new testing web user group. Then I created the Now You See Me document and assigned it the testing document group. Now nobody who isn’t logged in as someone who is a member of the "testing" web user group can see the private document. And it doesn’t matter how many people log in with the same username and password.

I have a guest user login for the manager of my site, and often have several people logged in at the same time. Occasionally I have to go in and clear locks, but that happens anyway.

By the way, this page will be great for anyone who is trying to make a snippet or plugin and needs to know what values are available from the SESSION under different conditions.