Prevent access to a specific view in cakephp

Question

I am developing a website with CakePHP.
I have an AdminsController for admins to authenticate. However I want create extra security by adding .htaccess password protection.

I tried to do it by adding .htaccess and a .htpasswd files in my Admins view directory since I want the other pages of my site to work normally, but it doesn't work.
So how to add .htaccess and .htpasswd for only a specific view?

In my AdminsControllers's beforeFilter method I've added :

if(env('HTTP_HOST') == 888.888.888.888 || ......), 

The list of IP addresses that should be allowed. Can I say that it is safe now?

Answer 1

I think you might want to investigate the other authentication components that CakePHP has to offer. BasicAuthenticate should be of particular interest.

If you go down this route, the authentication will still happen against a userModel rather than a .htpasswd file.

As for the IP restriction, that should be relatively safe. IP spoofing is possible but hard.