X3Photo Gallery Forums

Martin wrote:First: there is a typo, I belief:
"* Select either a user OR username and password (or both)."
should be:
"* Select either a user OR username and password (not both)."

Actually, you can select both user and username+password ... although I don't see why one would want to mix methods like this.

Martin wrote:Second, I was testing with "New Incognito Window", but only the first of such a session gives me the login-box. After closing the Incognito window en starting a new one, I do not have to login again but I'm seeing the protected folder immediately.
Changing user/password and starting another new Incognito window does not help either.
FOUND IT: when using Cloudflare you have to flush all pages after adding/changing users/passwords (and still use the Incognito window when testing).
Strange... isn't it?

You are using Cloudflare page-caching? If you are, then yes Cloudflare is entirely related. If not, then it's not related to Cloudflare at all ...

Martin wrote:Well, in your '?-help' screen of Page Password Protection you mention:
" * You should select either a user OR username+password, not both."
So, I thought it's not allowed.

Yep, well you should use one or the other, I don't see any reason to use both schemes in combo ... It is allowed though. These things could be better worded for sure, always room for improvements!

mjau-mjau wrote:Yes, I'm using Cloudflare. I only wanted to be sure, so others will be aware of this when they encounter the same issue.

My question was actually if you had specifically set up Cloudflare "page caching"? If you are not sure, the answer would be "no" ... If the answer is "no", Cloudflare should not affect the password system, in which case I would be interested in digging deeper into the issue you experienced ... Are you using the preload feature?

Cloudflare page-caching is some high-tech, but dodgy stuff... Its a neat feature, but it breaks all "dynamic" features like logins etc ... I just wrote a new post about this on my blog:
https://mjau-mjau.com/blog/cloudflare-page-caching/

Martin wrote:Well, I think I've got page caching. I installed Cloudflare a while ago conform your manual.
When I look in Cloudflare I find in 'Page Rules' a special rule for "martinbroeze.nl/panel" and another one for "martinbroeze.nl".
These were made conform your instructions.

Yep, after some tests, I can confirm you are using page-caching. The problem with page-caching is that is breaks dynamic pages ... and your passworded-pages is such a page. Basically the page could display "unauthorized" OR show the page ... in either case, the page will get cloned and cached on the Cloudflare network after the first visit (likely by you). Therefore, it will store a cached version of the output, which by no means makes the login prompt, well ... because its just a cached version of the page output. Super fast? yes. Compatible with dynamic pages? no.

This is why you have an additional rule for the panel, so that this section is EXCLUDED from page caching (so the panel works). If you want to continue using page-caching AND passworded-pages, you would have to set up page-rules separately for each passworded-page, as you have done with the panel.

The only other option, is to disable page-caching ...