Referring to https://ellislab.com/expressionengine/user-guide/cp/design/templates/template_access.html#http-authentication

Right now a failed or canceled authentication redirects to the standard server 401 page.

Is there any way to have this redirect to a specific url?


If you look in the EE source (v.2.10.1) you will see the following in system/expressionengine/libraries/Auth.php (line numbers on the left):

156                 if ($authed === FALSE)
157                 {
158                         @header('WWW-Authenticate: Basic realm="'.$realm.'"');
159                         ee()->output->set_status_header(401);
160                         @header("Date: ".gmdate("D, d M Y H:i:s")." GMT");
161                         exit("HTTP/1.0 401 Unauthorized");
162                 }

EE's authentication hijacks the 401 response, dumping out a header and using PHP's exit() function to dump out an "helpful" text string. AFAIK, and based on this evidence, there is no way to catch a 401 HTTP error code in a template, or even a raw Apache directive, without hacking the EE source, which is not recommended.

I have submitted this as a bug to Ellis Labs but have no heard anything back yet. If I do, I will add it to my own SO question that is similar to this.

  • Cheers mate, keeping an eye on this one. – erwinheiser Aug 1 '15 at 22:11
  • It doesn't "hijack the 401 response"; since PHP is being called upon to provide the HTTP Auth mechanism at this point, it is PHP's responsibility to throw a 401 on failed authentication. php.net/manual/en/features.http-auth.php AFAIK, it is not possible to let Apache handle this ErrorDocument unless Apache is providing the HTTP Auth mechanism. – Derek Jones Mar 5 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.