Is it alright to put .htpasswd in the protected directory if there's just one user?

Question

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory:

Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.

It's not clear to me exactly what this means. Is it only authorized users that may be able to download it, or is there a risk that others may have access as well?

The directory I am protecting will only ever have one authorized user. He already knows his username and password. Is there any reason not to keep the .htpasswd file in the protected directory right next to .htaccess?

Answer 1

By default, Apache is suppose to deny access to .htaccess and .htpasswd files. For some weird reason, you have the ability to disable it (accidentally or otherwise) in your configuration. If you have disabled this protection somehow (or if, for some reason, it wasn't setup in the first place), then any malicious attacker could exploit this to download the .htpasswd file.

Normally the suggestion is to have the file outside of your web directory, preventing it from ever being served to a user, while still giving Apache access to it.