Password protection in .htaccess doesn't ask for password - .htaccess

Question

I'm trying to password protect a directory called 'test'.
This is what I've done so far (inside of the test directory)
File .htpasswd:
testuser:$apr1$qw60eHhx$14S4S2Mxx/26EgXqmb7Pw1
File .htaccess
<files /var/www/html/test>
#Protect Directory
AuthName "Dialog prompt"
AuthType Basic
AuthUserFile /var/www/html/test/.htpasswd
Require valid-user
</files>
When I call the directory in my browser, it doesn't ask for a password. Am I missing out on something? What could be the reason for that?

Answer 1

I just now realize that you are using a distributed configuration file (".htaccess"). In there blocks like <Files ...>...</Files> or <Directory ...>...</Directory> do not make much sense. And actually that is documented and pointed out in the http server's error log file. That leaves us with two options:
Either use the actual http server's host configuration (which should always be preferred if possible):
DOCUMENT_ROOT /var/www/html/test
<Directory /var/www/html/test>
#Protect Directory
AuthName "Dialog prompt"
AuthType Basic
AuthUserFile /var/www/html/test/.htpasswd
Require valid-user
</Directory>
This works, I re-checked with one of my own systems.
Or use a distributed configuration file (.htaccess), which means you need to grant altering access permissions in your http server's host configuration first using the AllowOverride directive. And you need to leave away the enclosing block which does not make any sense within that folder. So the actual ".htaccess" style file should just read:
#Protect Directory
AuthName "Dialog prompt"
AuthType Basic
AuthUserFile /var/www/html/test/.htpasswd
Require valid-user
Both files need to be readable by the http server process. And the file permissions for the .htpasswd file require precision, again see the documentation for details. Also I would clearly recommend not to store such a file within the published documents folder, but outside of where the http server finds documents to publish. For obvious reasons...
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using distributed configuration files (".htaccess"). Those distributed configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).