Protect static files on Apache with OpenID
I moved from static HTML pages to web applications and back to static HTML files. There’s a lot to be said for the simplicity and portability of a bunch of files. Static site generators like Jekyll are increasingly popular; I’ve built a simple publisher that I use extensively.
Web apps give you something else, though, that are still useful on a static site. Access control. I’ve been resorting to htpasswd to protect static files, and it’s far from optimal. I don’t want to know or manage users’ passwords. I don’t want them to remember a new ID. I just want to allow specific people to log in via their Google Accounts. (OpenID is too confusing, and most people use Google anyway.)
The easiest option would be to use Google AppEngine. But their new pricing worries me. Hosting on EC2 is expensive in the long run. All my hosting is now out of a shared Hostgator server that offers Apache and PHP.
So, obviously, I wrote a library protects static files on Apache/PHP using OpenID.
Download the code
Say you want to protect /home/www
which is accessible at http://example.com/.
- Copy
.htaccess
and_auth/
under/home/www
. - In .htaccess, change
RewriteBase
to/
In
_auth/
, copyconfig.sample.php
intoconfig.php
, and- change
$AUTH_PATH
to http://example.com/ - add permitted email IDs to
function allow()
Now, when you visit http://example.com, you’ll be taken to Google’s login page. Once you log in, if your email ID is allowed , you’ll be able to see the file.
Feel free to try, or fork the code.