Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Am using Nginx as a reverse proxy to an Apache server that uses HTTP Auth. For some reason, I can't get the HTTP_AUTHORIZATION header through to Apache, it seems to get filtered out by Nginx. Hence, no requests can authenticate.

Note that the Basic auth is dynamic so I don't want to hard-code it in my nginx config.

My nginx config is:

server {

    listen   80;
    server_name ;

    access_log  /var/log/nginx/;

    gzip on;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 120;

    location / {
            proxy_pass http://localhost:81/;

    location ~* \.(jpg|png|gif|jpeg|js|css|mp3|wav|swf|mov|doc|xls|ppt|docx|pptx|xlsx|swf)$ {
    if (!-f $request_filename) {
                proxy_pass http://localhost:81;

            root /var/www/example;

Anyone know why this is happening?

Update - turns out the problem was something I had overlooked in my original question: mod_wsgi. The site in question here is a Django site, and it turns out that Apache does get the auth variables passed through, however mod_wsgi filters them out.

The resolution is to use:

WSGIPassAuthorization On

See,-mod_wsgi-and-HTTP-Authentication.html for more details

share|improve this question
You could also add this to your .htaccess: RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] – barius Sep 8 '14 at 16:46

I'm not sure this will work, but try adding this:

proxy_pass_request_headers on;
proxy_no_cache $cookie_nocache  $arg_nocache$arg_comment;
proxy_no_cache $http_pragma     $http_authorization;
proxy_cache_bypass $cookie_nocache $arg_nocache $arg_comment;
proxy_cache_bypass $http_pragma $http_authorization;

If that doesn't work try this too:

proxy_set_header HTTP_AUTHORIZATION $http_authorization;
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.