title: PHP and .htaccess authentication solution
body: <p>Here's the layout:</p>
  
  <pre><code>web root
    - admin (dir)
        - index.php
        - js
        - img
        - other files / dirs
    - dir
    - files
  </code></pre>
  
  <p>Until now, I protected the admin dir with .htaccess passwd because I want full access control for all files in that dir (including js scripts, jpg, pdf etc). On the other hand, my custom CMS provides authentication using PHP sesssion / cookie for other URLs. What I want to accomplish is to use the same PHP authentication for the .htaccess protected dir, avoiding the popup prompt for user / password for already PHP authenticated users. In summary:</p>
  
  <ul>
  <li>I want the admin dir to use the .htaccess rules for authentication</li>
  <li>If a user is already authenticated using PHP (login in a HTML form, on a non-protected file), bypass the second .htaccess authentication process when accessing the admin dir content</li>
  <li>If a non PHP authenticated user tries to access content in the admin dir, the HTTP auth popup should be triggered</li>
  </ul>
  
  <p>Most of the stuff that I've read suggest to move the admin dir outside the web root and access the files from a PHP script with readfile, which I don't want to do. There's dynamic content on that dir, as well as static. I know that apache will trigger the auth popup before loading any resources so the question is how to make apache aware that the user is already authenticated. Any other suggestion / workaround?</p>