I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory:
Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.
It's not clear to me exactly what this means. Is it only authorized users that may be able to download it, or is there a risk that others may have access as well?
The directory I am protecting will only ever have one authorized user. He already knows his username and password. Is there any reason not to keep the .htpasswd file in the protected directory right next to .htaccess?