.htpasswd security question

[samhs]

Is there any reason I shouldn't locate a .htpasswd file in the directory which it protects (eg if I protect a folder called "images" using a .htaccess located in that directory, and point to the .htpasswd file also located in that same "images" directory) - is that bad from a security POV? Assume I have no telnet/ssh access to the server in question so can only access the public folder and below...

TIA

[Jeep Stone]

On our server the .htaccess and .htpasswd are in the same location for each folder. Apache is normally configured to prevent direct access to .ht* files IIRC.

[SLEE]

i think if you want to be super secure then the .password is supposed to be under the root of you site so no one can reach it through the web.

[samhs]

When you say "super secure" - what are the risks/possible exploits associated with locating the files in the folder being protected?

[JasonD]

None.

Access to .ht files is forbidden by default configuration (and there is no valid reason to change that).
You already need a valid login to access anything in the directory.
Passwords are not stored in plain text.

Reasons to store the passwords elsewhere are mostly administrative, you don't need to maintain multiple password files for the same users to login to different parts of the same site, or different sites on the same server.

[samhs]

excellent - thanks