How to protect Directory browsing in Apache ?

You can protect your directories in two ways. You can use
.htaccess file to protect or using httpd.config file. You
cannot protect a webserver with any other methods.

Option 1: Protect the directory tree with username/password
          with .htaccess
-----------------------------------------------------------

In this method to protect a directory tree (with
username/password or IP mask) follow the steps below:

Steps for putting a .htaccess file in the given
subdirectory.

  Step 1) Using a text editor (notepad NOT wordpad) copy the
          following lines:

          order allow,deny
          allow from all
          require valid-user
          Authname DirectoryName
          AuthPAM_Enabled off
          Authtype Basic
          AuthUserFile /path/to/your/.htpasswd

  Step 2) Change DirectoryName to any descriptive name for
          your password protected directory. Change
          /path/to/your/.htpasswd to the path to your
          .htpasswd file.

          If you do not know what an .htpasswd file is use
          /home/sites/www.domain-name/.htpasswd replacing
          www.domain-name with your actual domain name.

  Step 3) Upload this file to the directory you want password
          protected. The file MUST be uploaded in ASCII mode.
          The file must be named .htaccess

  Step 4) Telnet to the server

  Step 5) For the first user you allow access to the
          directory use the following command replacing
          username with the actual name and www.domain-name
          with your domain name.

   /usr/sbin/htpasswd -c /home/sites/www.domain-name/.htpasswd
username

          The server will promt for a password which must be
          entered twice.

  Step 6) For each additional user you allow access to the
          directory enter the following command:

   /usr/sbin/htpasswd /home/sites/www.domain-name/.htpasswd
username

Option 2: Protect the directory tree with with httpd.conf
---------------------------------------------------------

Using this method, you can protect a directory centrally
without using .htaccess files distributed through the file
system.

Put directories in your httpd.conf file that would protect
the tree.  You use basically the same directives you would
in a .htaccess file, but put them inside a directory block
as below:

<directory /htdocs/protected>
 ... contents of your htaccess file
</directory>

Sample:

  <directory /ccuu/protected>
    AuthName "restricted stuff"
    AuthType Basic
    AuthUserFile "c:/program files/apache/conf/user01"

    require user myuser
   </directory>

Try c:/ccuu/protected if you are using in Windows NT since
it needs to be absoulute path. Not the relative path.

If you want to avoid having someone override your
permissions with a .htaccess file.  You might want to
include "allowoverride none"  with your other directory
directives here.


BTW: Anything you could do with .htaccess files could be
done in the conf file.  The benefit of using .htaccess is
you don't have to restart the server or have access to
the conf files to make changes in permissions to a
particular directory. The drawback is the server has to
read your .htaccess file everytime someone tries to read
from that directory.  You gain flexiblity, but lose some
performance.

Option 3:

Another workaround could be to use temporary directories
that have random names and only exist for as long as the
user is browsing your site.