Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use a service provided by a server which requires basic HTTP authentication, however the application I am using does not support authentication. What I'd like to do is create a proxy that will enable my auth-less application to connect via the proxy (which will add the authentication information) to the server requiring authentication. I'm sure this can be done, however I'm overwhelmed with the number of proxies out there and couldn't find an answer how to do this.

Basically it seems all I want to do is have a proxy serve this URL:


as this URL:


I can run it on Linux, but a plus if I can run it Windows as well. Open source or at least free is a must. A big plus is if it's fairly straightforward to setup.

share|improve this question
up vote 3 down vote accepted

Basic Authentication normally is a Base64 Encoded String of "username:password" and a HTTP-Header "Authorization".

By adding the following to a Apache2 vHost you should be fine:

<Location /path>
    RequestHeader set Authorization "Basic <base64string>"

ProxyPass /path http://backend/path
ProxyPassReverse /path http://backend/path

You can base64 encode the "username:password" part at (for example). The example above needs mod_headers and mod_proxy (should be available for both - Linux and Windows - with Apache2.

share|improve this answer
I've tried that out, but keep on getting a 403 error. Perhaps it's using some other form of authorization? Unfortunately I'm not too familiar with HTTP; I thought anytime a site causes the browser to pop up a dialog box asking for username and password that it was using basic authentication. I see there's a digest method, perhaps it's using that? I think that makes it quite a bit more complicated... Thanks for the answer! – joshdoe Feb 23 '11 at 21:29
@joshdoe What's in the Backend Webservers Access-Log? Does it show a Username in the request? " - username [date] "GET uri HTTP/1.0" ..." May be you encoded a wrong string? Should be "username:password" without quotes. – hexa Feb 28 '11 at 11:48

You can also modify requests (add / alter headers) in some other packages, such as WinGate on Windows.

If you see a browser popup dialog, that usually means you're getting a 407 response from a proxy or 401 from the end server, it's not necessarily an indication of the use of HTTP Basic auth.

You can log auth challenge fields, or just use wireshark to see what's going on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.