Password Protect CMS Page

[Thomas44]

Hi,

I want to password protect a CMS page - simple password login form is all that is needed.

Not a customer login, just simple password protected login form to access content.

I recall using a snippet that allowed me to update layout XML to decalre the password, but can't find it anymore.

Can anyone recommend a password protection extension or snippet to pull this off?

Thanks.

[robfico]

Here are a few links that may help...

old example:
http://www.comprepairgurus.com/protect-magento-pages/

Only logged in users can see CMS pages:
http://marius-strajeru.blogspot.com/2012/08/how-to-make-cms-pages-available-only-to.html

simple password protect using .htaccess:
http://www.elated.com/articles/password-protecting-your-pages-with-htaccess/

[GauravMehta04]

It seems that you're looking something like user enter password before go into CMS pages and that pasword should be set by admin (means you) from backend..  Is it something you're talking about ?

[Girvin]

Was this ever figured out?  I have a client asking for a similar setup.  They want to be able to have a flash sale area where only people who are email a specific password can access the shop, cart and checkout pages.  The password will change weekly and they want to be able to do this.

Currently I am thinking it will be a form asking for a password which I will setup in Custom Variables.  If correct a cookie is stored with a short life, otherwise an error message is shown.

If there is a better method, I would love to hear it.

[cbyklum]

Has anyone answered this? I have the same question.

[NCMW]

Simple solution I found but I am not 100% convinced its secure but seems to block the CMS page unless you have entered the right password.  Add this to the top of your CMS page content:

<script type="text/javascript">
    var password = 'password123'
    var retVal = prompt("Enter your password : ", "your password here");
    if(retVal !== password)
    {
        location.assign('');
    }
</script>

<!--START OF CONTENT-->

• var password: would be the password you want for the CMS page.
• location.assign(''); - seems to work better without the ('#').

Hope this helps!

[KristaHMoso]

Is there any way or any additional code that would allow the entered password to "hold" for their session? Every time a user navigates away from that cms page, it makes them re-enter the password which I could see as being frustrating to the customer. Thanks in advance!

[KristaHMoso]

Is there any way or any additional code that would allow the entered password to "hold" for their session? Every time a user navigates away from that cms page, it makes them re-enter the password which I could see as being frustrating to the customer. Thanks in advance!

[Stokes82]

Seems to work but the only thing I see is when you go to put text under the <!--start of content-->

it's all pushed to the far left side of the page.  Guessing maybe a div or something will have to be added for this but I could be wrong.  Going to keep playing to see what I can come up with.  Any ways thanks for this little gem.  No one seems to have an extension for M2 that will do this yet. 

[rickdaalhu92ab]

Late to this thread but wanted to share what worked for me.

So I had this client who needed some pages password protected, and I first tried this super basic JS approach:

<script type="text/javascript">
let password = prompt('Enter Password:', '');
password !== 'Secret123' && (location.href='/');
</script>

Worked ok but it's pretty janky, anyone can see the password in the page source, plus users had to keep entering it whenever they refreshed. Not great.

Then I switched to using Nginx which was better:

location ~ ^/specific-cms-page(/.*)?$ {
    auth_basic "Restricted Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

This fixed the security issue, but my client kept asking me to change passwords or add new protected pages like every week.

So I ended up making an extension that lets them handle all this stuff themselves right in the Magento admin. They can protect whatever pages they want with different passwords without calling me every time.

If anyone's interested, I put it on the marketplace (yep, I'm the dev): https://commercemarketplace.adobe.com/upvado-magento2-module-page-restriction.html

Honestly, if you're just protecting one page forever, the Nginx approach is fine. But if you need something more flexible that non-techies can manage, an extension makes life way easier.