looking for apache module to strip u/pw from URL

security related

[steven]

Accessdiver and related brute force hacking programs rely to some degree on apache accepting URL's with an embedded username and password. E.G.

[username:[e-mail]...]

If there an apache module that would strip the username and password from any URL's submitted like this, but not affect the normal workings of .htpasswd/.htaccess authorization?

Many thanks in advance.

[dcrombie]

I think there was a thread on this last week that concluded that the username, password component were actually passed using 'proper' HTTP authentication channels and so don't appear to Apache to be any different from the results of a 'login box'.

[steven]

Yeah, thanks, I checked first and missed that thread, then found it while looking for something else. Typical. Shame there's doesn't appear to be any delete option, otherwise I would have deleted the post.