title: Apache mod_auth_form how to lock down a folder
body: <p>It seems to me that I have a fundamental misunderstanding how "mod_auth_form" is supposed to work. I refer to this page of the Apache documentation: </p>
  
  <pre><code>http://httpd.apache.org/docs/current/mod/mod_auth_form.html
  </code></pre>
  
  <p>I have a public folder and a private folder</p>
  
  <p>What I want to achieve is that a folder is locked down. The users will need to sign in with their user name and password to see the index.php page of my protected folder.</p>
  
  <p>Here is my virtual host setup:</p>
  
  <pre><code>&lt;VirtualHost  *:80&gt;
      ServerName customform.uwe
      DocumentRoot "/home/uwe/www/protected_custom_form"
      DirectoryIndex index.php
      ErrorLog /var/log/apache2/protected_custom_form.error.log
      CustomLog /var/log/apache2/protected_custom_form.access.log combined
  
      &lt;Directory "/home/uwe/www/protected_custom_form"&gt;
          AllowOverride All
          Allow from All
      &lt;/Directory&gt;
  
      &lt;Directory "/home/uwe/www/protected_custom_form/secret/"&gt;
  
      &lt;/Directory&gt;
  
      &lt;Location /dologin&gt;
          SetHandler form-login-handler
          AuthFormLoginRequiredLocation http://customform.uwe/login.html
          AuthFormProvider file
          AuthUserFile /home/uwe/www/conf/passwd
          AuthType form
          AuthName realm
          Session On
          SessionCookieName session path=/
          SessionCryptoPassphrase secret
      &lt;/Location&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Here is my login form which is hosted in the public folder of my virtual server:</p>
  
  <pre><code>&lt;form method="POST" action="/dologin"&gt;
      Username: &lt;input type="text" name="httpd_username" value="" /&gt;
      Password: &lt;input type="password" name="httpd_password" value="" /&gt;
      &lt;input type="submit" name="login" value="Login" /&gt;
      &lt;input type="hidden" name="httpd_location" value="http://customform.uwe/secret/index.php" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>OK, here is what happens</p>
  
  <ol>
  <li>going to 'customform.uwe' works nicely -> I see my index page for this folder being displayed</li>
  <li>going to 'customform.uwe/login.html' -> I see my login form coming up and I can sign in and am redirected to my 'index' page of my secret 'folder'</li>
  <li>going to 'customform.uwe/secret/index.php' show me my index pagge signed in or not.</li>
  </ol>
  
  <p>Here my question:</p>
  
  <ol>
  <li>How do protect my secret folder so that a not signed in user is being redirected to the login form.</li>
  <li>Is this the right approach altogether?</li>
  </ol>
  
  <p>I am really banging my head against the wall at the moment, so thanks a lot for your help.</p>
  
  <hr>
  
  <p>OK, I believe I have got it sorted now. I must have got a bit confused :-)</p>
  
  <p>The idea I followed includes two things:</p>
  
  <ol>
  <li>Provide a log in functionality</li>
  <li>If a user goes to a page where he/she needs to be authenciated - and he/she is not - redirect the user to the login page</li>
  </ol>
  
  <p>To achieve that I needed to edit two files:</p>
  
  <ol>
  <li>My Virtual Host</li>
  <li>My login file</li>
  </ol>
  
  <p>This is the Virtual hosts:</p>
  
  <pre><code>&lt;VirtualHost  *:80&gt;
      ServerName customform.uwe
      DocumentRoot "/home/uwe/www/protected_custom_form"
      DirectoryIndex index.php
      ErrorLog /var/log/apache2/protected_custom_form.error.log
      CustomLog /var/log/apache2/protected_custom_form.access.log combined
  
      #This is the public
      &lt;Directory "/home/uwe/www/protected_custom_form"&gt;
          AllowOverride All
          Allow from All
      &lt;/Directory&gt;
  
      #This is the login handler, the login form needs to pint to this handler in its action! 
      &lt;Location /dologin&gt;
         SetHandler form-login-handler
         AuthFormLoginRequiredLocation http://customform.uwe/login.html
         AuthFormLoginSuccessLocation http://customform.uwe/secret/secretindex.php
         AuthFormProvider file
         AuthUserFile /home/uwe/www/conf/passwd
         AuthType form
         AuthName realm
         Session On
         SessionCookieName session path=/
         SessionCryptoPassphrase secret
      &lt;/Location&gt;
  
      # This is the location setting I missed earlier: When a 
      # user comes to this location unauthorised, he will be redirect to the login form
      # This happens as the ErrorDoucment gets overwritten with login page
  
      &lt;Location /secret/index.php&gt;
          Require valid-user
          AuthFormProvider file
          ErrorDocument 401 /login.html
          AuthUserFile /home/uwe/www/conf/passwd
          AuthType form
          AuthName realm
          AuthFormLoginRequiredLocation http://customform.uwe/login.html
          Session On
          SessionCookieName session path=/
          SessionCryptoPassphrase secret
  
      &lt;/Location&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>This is the login form html 
  The change in here is that the action handler of the form is now pointing to my location 
  which I defined above </p>
  
  <pre><code>&lt;form method="POST" action="/dologin"&gt;
      Username: &lt;input type="text" name="httpd_username" value="" /&gt;
      Password: &lt;input type="password" name="httpd_password" value="" /&gt;
      &lt;input type="submit" name="login" value="Login" /&gt;
      &lt;input type="hidden" name="httpd_location" value="/secret/secretindex.php" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>This seems to work, it was all (more or less) in the Apache documentation, but I got confused as their is no complete example</p>