Http authentication bypassed by php

[thom_ipg]

Hello,

I have a Plesk configured to use php fpm and I activated password protection for a folder.
When I try to go to the site's URL it triggers a http authentication (eg mywebsite.com) but when I want to access to a php file directly (eg mywebsite.com/index.php) even if the authentication failed the page is displayed.
For static files the authentication works well.

I looked the conf file generated by plesk and it uses the ProxyPassMatch directive for executing php. The problem seems to come from that according to this thread on stackoverflow : http://stackoverflow.com/questions/...-trigger-apache-http-basic-auth-for-php-pages

How can I force Plesk to generate a conf file using <FilesMatch \.php$>SetHandler "proxy:fcgi://127.0.0.1:9000"</FilesMatch> instead of ProxyPassMatch

Thanks in advance for your answers !

 

[thom_ipg]

I can't use mod_php to avoid this problem.
Can I edit manually the conf file or Plesk will regenerate it automatically?

Nobody had this issue?

 

[Eno]

I have the same problem and I think it's a big security hole ... If I say "protect directory" it should be close and do not execute php-scripts!
I have changed my PHP-settings to FastCGI ... that seems to work as aspected.

 

[thom_ipg]

Thank you a lot !
FastCGI avoid the problem, but it's not a real solution.

This is a big security hole in default settings !