Skip to content

Instantly share code, notes, and snippets.

Created August 10, 2012 18:20
Show Gist options
  • Save bbrewer97202/3316425 to your computer and use it in GitHub Desktop.
Save bbrewer97202/3316425 to your computer and use it in GitHub Desktop.
Simple htaccess authentication on Heroku with cedar/php

Create an .htaccess file in the webroot:

AuthUserFile /app/www/.htpasswd
AuthType Basic
AuthName "Restricted Access"
Require valid-user

Create a .htpasswd file:

htpasswd -c /app/www/.htpasswd [username]
Copy link

i am not sure i understand , how do you create the htpasswd on heroku? i tried the following command :

heroku run htpasswd -c /app/www/.htpasswd joe

but it tells me resource not found.

And when i do heroku run pwd it tells me that i am on the /app folder but
when running heroku run dirs it only shows me this folder. Am i missing something?

Copy link

ahh, i know now how after a bit of research .
it seems i had to do first "heroku run bash"
then cd into the app/www and create the htpasswd file
Now everything works nicely. Thanks man! Your post is really helpful

Copy link

bhas4 commented Mar 23, 2013

This does not seem to work, even though the /app/www/.htpasswd file exists.. fails with error saying unable to read the file on accessing the site.

Copy link

@bogdanRada it appears you can also simply create the .ht* files in your application root, which becomes /app/www/ when you push and deploy to the Heroku server

Copy link

panwaria commented Feb 2, 2014

@dmcycloid: That's right.
Does any one know how to configure Apache mod_rewrite on heroku and restart apache on heroku server, after you add .htaccess to the web root?

Copy link

dead thread?
Here's my htaccess - not working!
cat .htaccess
RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{HTTP_HOST} ^(www.)?$ [NC]
RewriteRule ^${REQUEST_URI} [R,L]~ $

Copy link

If you've specified a directory other than the default in your Procfile, eg:

web: vendor/bin/heroku-php-apache2 MY_WEB_DIR/

then the htpasswd / htaccess files won't be in app/www, they'll be in app/MY_WEB_DIR. So, change your path to the htpasswd file in htaccess to:


Copy link

xavriley commented Jun 3, 2016

Using heroku run bash for this won't work as the changes to the filesystem are lost each time the dyno reboots (which is at least every 24 hours).

You'll need to run

htpasswd -c /app/www/.htpasswd [username]

locally and commit the file to git before deploying.

Copy link

As of July 2016, some subtle changes are necessary on heroku-php-apache2. Please note that the path to the .htpasswd file no longer contains the www directory and that the .htpasswd file should be in the webroot as well.

Create an .htaccess file in the webroot:

AuthUserFile /app/.htpasswd
AuthType Basic
AuthName "Restricted Access"
Require valid-user

Create a .htpasswd file, also in the webroot:

htpasswd -c .htpasswd [username]

Commit local changes. Deploy to Heroku.

Copy link

Manishsfdc1 commented Sep 2, 2016

i have add both .htaccess. and in my root directory and commit the changes on heroku but it not show any authorization process or message.
I have used following code in my file.

Create an .htaccess file in the root:

AuthUserFile /app/.htpasswd
AuthType Basic
AuthName "Restricted Access"
Require valid-user

Create a .htpasswd file, also in the root :

htpasswd -c .htpasswd [username]

Please suggest some idea to get out of this problem.

Copy link

javier-tarazaga commented Jan 12, 2017

+1 here. Not working with .htaccess and .htpasswd in the root of the application. @cwmanning any ideas?

Wait, could this be because of this is running cedar/php? I am currently trying it with a nodejs project.

Copy link

Be careful that you're actually running apache, and not nginx (the latter of which takes no notice of .ht* files).

I suffered a major 'doh' moment when trying to set up authentication on a demo site, only to realise (after an hour or two of trawling through discussions like this one), that I was using a procfile that specified the nginx webserver...

web: vendor/bin/heroku-php-nginx

I switched it to...

web: vendor/bin/heroku-php-apache2

...redeployed, and my .htaccess/.htpasswd files took immediate effect.

Copy link

AWolf81 commented Jun 11, 2017

I cloned the repo and followed the getting started guide for php.

After the first deploy I wanted to use Auth Basic to secure the app.

Adding everything to the root of the app wasn't working for me. Not sure why it wasn't working but it looks like .htpasswd won't be added to the root directory of the app. After login in to the app with $ heroku run bash I couldn't find the .htpasswd at the root directory with $ ls -ah

For me it's working like following (same as bbrewer's code - just more details):

  • Add .htaccess file with the following content to ./web directory:

      AuthType Basic
      AuthName "Restricted access"
      AuthUserFile "/app/www/.htpasswd"
      Require valid-user
      RewriteEngine On
      RewriteCond %{REQUEST_FILENAME} !-f
      RewriteRule ^ index.php [QSA,L]
  • Procfile uses the ./web folder as web root - no changes here web: vendor/bin/heroku-php-apache2 web/

  • Then add in folder ./www the .htpasswd file with the command $ htpasswd -c ./www/.htpasswd username
    This will create a .htpasswd file inside of ./www with the content username:hashedpassword

Once setup everything you can commit your changes ($ git add . && git commit -m ...) and deploy the app with $ git push heroku master.

Screenshot of the php-getting-started example directory structure with Basic Auth:

Copy link

You can also use the /app/Providers/RouteServiceProvider.php and the "auth.basic" middleware for that:

protected function mapWebRoutes(Router $router)
    $middlewares = ['web', 'hasTeam'];
    if(env('AUTH_BASIC', 0)){
        array_push($middlewares, "auth.basic");

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment