Ubuntu 16.04 Apache2只需要输入一次密码？

Question

I have a server running, and setup an htaccess file. Everything works and it does require a password to gain access to the folder I set, but once the password is used, it has never required verification again. Seems insecure, so I'm wondering how to require re-entering a password. Like some kind of time-out on the access, but I don't know what to look for, and all I've found is people trying to stop needing a password all the time.

Please help with either a solution, or point me in the right direction for what I need to be searching for.

I am using ssl, and .httaccess file with basic auth setup in the apache config file.

<Directory "/var/www/html">
  AuthType Basic
  AuthName "Restricted Content"
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
</Directory> 

Answer 1

As I know, apache/HTTP authentication don't gives you control. After first authentication, your server cannot instruct the browser to logout or timeout. HTTP authentication does not work with session/cookies and the browser shall continually send authentication credentials. To logout you should close the browser.

looking in Apache webpage: AuthDigestNonceLifetime Directive could be useful the value is in seconds for the time. i use 300 here.

<Directory "/var/www/html">
    AuthType Digest
    AuthName "Restricted-Content"
    AuthDigestDomain "http://127.0.1.2"
    AuthDigestProvider file
    AuthUserFile /etc/apache2/.htpasswd         
    AuthDigestNonceLifetime 30          
    Require valid-user
</Directory> 

Also you will have to use the htdigest command to generate the .htpasswd file

htdigest -c /etc/apache2/.htpasswd Restricted-Content username

then set the password then set the AuthDigestDomain to your URL or IP

this conffiguration can only work with the degest based authentication. although the user must clear their browser cache manually.

but i would recommend you switch to a different method for autentication, unless its the only option for the application