Forums

Password protection for in-progress sites not working for custom domains?

Hello,

I just started a new app with a custom domain but password-protecting it doesn't seem to work. The authentication dialog never appears and you get right in. I tried reloading a couple of times, cleared cookies, different browsers, etc. but no change. I have another app on the standard domain and pw-protection works fine.

I have a CNAME for the domain and a redirect (URL record, naked -> www) at DNSimple but otherwise nothing special.

Any thoughts?

lillian

Hi there -- the only custom domain I can see for your account has a username and a password set, but the "Password protection" slider is switched to "Disabled". I didn't want to switch it to "Enabled" to test the problem without your say-so...

If you switch it to "Enabled" and reload again and still don't see the authentication dialog, let me know and I'll investigate it further.

Wow, OK. I guess things DO work if you turn them on :-/ I'm sure I had that enabled yesterday but who knows at this point. I blame sunspots or having too many tabs open or not enough coffee.

In any case thanks for looking into this.

No problem! Just let us know if it stops working again for whatever reason.

Bumping because this just happened to me again (in a client's account this time). I have it working as expected now but this is the sequence of events:

  • Created new web2py app for custom domain
  • turned on password protection
  • verified that I did indeed have it enabled
  • reloaded app but no auth dialog appears on page load
  • reloaded again, waited, no change
  • logged out and back in
  • password protection now shown as DISABLED
  • enabled it again and reloaded
  • auth dialog now appears on page load

So something is going on in there.

Hm. I'm inclined to blame the little js widget we use to show that blue slider thing. We'll have a look into it.

Thanks very much for reporting it.

Experienced a very similar problem - that widget seems to be buggy. At one point the password protection widget said disabled, but the password request was coming up upon loading the app. When I logged out of pythonanywhere and logged back in, the widget then said that password protection was enabled. When I disabled it, it worked. Not clear why sometimes the widget seems to work and other times it does not.

@rottman...did you reload the app after toggling the password protection on/off? That could be the cause of your issue from what I read. I found that I need to reload the app after each toggle on/off for it to take effect.

This is all very odd. Irritatingly, it's really hard to reproduce, but I've definitely managed to get it to fail as everyone has described on my test system -- just not consistently. We'll have to look into it.

The best recommendation I can make right now is that after changing it, you refresh the page (using the browser refresh button) and confirm that it has "taken". If it hasn't, toggle again, refresh again, and it should have worked. This should at least eliminate the uncertainty about what the state of your site is. But I appreciate that this is a real pain to have to do, and we'll work out a proper fix.

Hello, I am also not able to sign-in to the site with the password getting the same error. Initially my password protection was Enabled,but now I have Disabled .Even after reloading the app using the browser refresh button the page shows the sign-in. I have tried the following: 1.Entered the credentials even though the slider is Disabled in the password protection field,but it didn't work either way. 2.Logged out of pythonanywhere and cleared the cookies etc and logged in again with slider still in Disabled ,the site still shows sign-in.

Note: the username and password field still retains the value even when the slider is Disabled.Thought it should be cleared. Can anyone advise on this

You need to reload the website using the green button at the top of the "Web" page inside PythonAnywhere in order to finalise the change to the password protection toggle -- just refreshing the page in the browser isn't enough.