# How to Catch a Status 401 with htpasswd?

**URL:** <https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007>\
**Category:** Rails\
**Created:** [October 15, 2008, 8:34pm UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007 "2008-10-15T20:34:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 15, 2008, 8:34pm UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/1 "2008-10-15T20:34:59Z")

</div>

Hi All,

I would love to hear your thoughts on this.

I am using the htpasswd plugin located here:  
[http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/](http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/)

To validate access against a .htpasswd file. The plugin is working  
great but currently if you fail to get the PW correct and generate a 401  
(Unauthorized) the user is presented with a completely blank page.

My goal is to at least redirect them to the home page or present a  
message saying their login attempts have failed.

Here is what i have tried:  
#application.rb  
rescue\_from Htpasswd::UnknownUserAccount, :with =\> :http\_status\_code

def http\_status\_code  
redirect\_to “[http://someplace.com](http://someplace.com)”  
end

^---- The above does nothing and does NOT catch anything. I have tried  
with Htpasswd::Error, and ActiveResource::UnauthorizedAccess –  
nothing.

I have also tried a before filter with a method in application.rb  
calling htpasswd but i get an error saying the htpasswd method does not  
exist.

Any input or even a starting place where i can begin researching would  
be great .

THANK YOU!

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 17, 2008, 2:24am UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/2 "2008-10-17T02:24:03Z")

</div>

If anyone has a suggestion for a starting point on where I can begin  
trying to figure this out i’d really appreciate hearing it.

thanks

Mm Zz wrote:

> Hi All,
> 
> I would love to hear your thoughts on this.
> 
> I am using the htpasswd plugin located here:  
> [http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/](http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/)
> 
> To validate access against a .htpasswd file. The plugin is working  
> great but currently if you fail to get the PW correct and generate a 401  
> (Unauthorized) the user is presented with a completely blank page.
> 
> My goal is to at least redirect them to the home page or present a  
> message saying their login attempts have failed.
> 
> Here is what i have tried:  
> #application.rb  
> rescue\_from Htpasswd::UnknownUserAccount, :with =\> :http\_status\_code
> 
> def http\_status\_code  
> redirect\_to “[http://someplace.com](http://someplace.com)”  
> end
> 
> ^---- The above does nothing and does NOT catch anything. I have tried  
> with Htpasswd::Error, and ActiveResource::UnauthorizedAccess –  
> nothing.

> I have also tried a before filter with a method in application.rb  
> calling htpasswd but i get an error saying the htpasswd method does not  
> exist.

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 17, 2008, 10:02am UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/3 "2008-10-17T10:02:20Z")

</div>

In ./lib/htpasswd/auths/base.rb I found two exceptions that are raised  
for an  
invalid account and password: Htpasswd::UnknownUserAccount and  
Htpasswd::IncorrectPassword.

Try rescuing the latter. See if that does the trick.

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 17, 2008, 10:02am UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/4 "2008-10-17T10:02:21Z")

</div>

Sorry for replying twice… caught this after I sent the first one.

All of your error classes are in ./lib/htpasswd/class\_methods.rb:

class Error \< StandardError; end  
class HeaderNotFound \< Error; end  
class UnknownSchemeError \< Error; end  
class NotAuthorizedError \< Error; end  
class ConfigurationError \< Error; end

class UnknownAccessControl \< ConfigurationError; end  
class AuthSchemesNotDefined \< ConfigurationError; end  
class IncorrectPassword \< NotAuthorizedError; end  
class UnknownUserAccount \< NotAuthorizedError; end

There’s your two classes at the bottom. I would suggest rescuing  
Htpasswd::NotAuthorizedError, so that you catch both incorrect passwords  
and  
unknown accounts. That would be a more secure way to go, so you don’t  
inadvertently reveal which user accounts are valid.

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 19, 2008, 1:12am UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/5 "2008-10-19T01:12:00Z")

</div>

Hi Patrick,

Thank you so much for taking the time to look into the plugin’s code and  
offering advice.

I gave it a shot and it appears my rescue\_from is being ignored:

This is what i have in application.rb (just for testing)

##application.rb  
rescue\_from Htpasswd::NotAuthorizedError, :with =\> :badlogin  
def badlogin  
redirect\_to “[http://www.google.com](http://www.google.com)”  
end

when the pw box comes up, i put in bad login info… and it just loops  
infinitely prompting me with the login/pw fields.

In my server log i have this over and over:

Processing PostsController#index (for 127.0.0.1 at 2008-10-18 15:54:41)  
[GET]  
Session ID:  
BAh7BiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNo  
SGFzaHsABjoKQHVzZWR7AA==–b13da02c3dcb245cb43911897a5d940881991d88  
Parameters: {“action”=\>“index”, “controller”=\>“posts”}  
Htpasswd is enabled with {:schemes=\>#\<Set: {:basic}\>}  
Htpasswd accepts authorization header: ‘Basic YXdlZmF3ZWY6’  
Htpasswd error(Htpasswd::UnknownUserAccount):  
Htpasswd::UnknownUserAccount  
Htpasswd sending authenticate header: ‘Basic realm=“Authorization”’  
Filter chain halted as [:htpasswd\_authorize] rendered\_or\_redirected.  
Completed in 0.00386 (259 reqs/sec) | Rendering: 0.00101 (26%) | DB:  
0.00000 (0%) | 401 Unauthorized [[http://localhost/posts](http://localhost/posts)]

Looking at the bottom of  
[http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class\_methods.rb](http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class_methods.rb)  
it appears the plugin is rescuing it’s own error?

Do you think it is stepping in before my “rescue\_from”? If so, is it  
possible to work around that some how?

thx again.

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 21, 2008, 7:21pm UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/6 "2008-10-21T19:21:22Z")

</div>

I see the following starting on line 70 of  
[http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class\_methods.rb](http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class_methods.rb)  
:

rescue Htpasswd::Error =\> error  
logger.debug “Htpasswd error(%s): %s” % [error.class, error.message]

Since i do notice this debug statement is printed in my dev log, is it  
safe to say the error is rescued before my “rescue\_from” is triggered?

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 29, 2008, 10:01pm UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/7 "2008-10-29T22:01:49Z")

</div>

any takers on help with this? 🙂

thank you

---

<div class="post-metadata">

**Author:** ![ziggles](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/7ba0ec/32.png) [@ziggles](https://www.ruby-forum.com/u/ziggles)\
**Post date:** [October 30, 2008, 8:05am UTC](https://www.ruby-forum.com/t/how-to-catch-a-status-401-with-htpasswd/151007/8 "2008-10-30T08:05:46Z")

</div>

Mm Zz wrote:

> any takers on help with this? 🙂
> 
> thank you

Here is the solution thanks to an Awesome gent in #rubyonrails…

Since  
[http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class\_methods.rb](http://wota.jp/svn/rails/plugins/branches/stable/htpasswd/lib/htpasswd/class_methods.rb)  
is rescuing Htpasswd::Error =\> error around line 70, i overrode the  
htpasswd\_authorize method by doing the following:

- Created lib/hacks/htpasswd\_hack.rb

- Dropped the following into that file:  
module Htpasswd

end

- In application.rb added this on line 1:  
require ‘lib/hacks/htpasswd\_hack’

And finally i ended all that by dancing a jig.

THANKS to Patrick for responding to my help request.