Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an internal server that needs to rewrite inbound requests to another internal box, for stupid reasons, both machines have basic auth enabled on them. To get around the two levels of auth, and because these are only internal servers, I thought that I could do somethign like this:

RewriteCond %{REQUEST_URI} /api/service
RewriteRule /api/service/(.*)$1 [L,P]

My expectation, is that uname:pword will get carried along the the next server when this rewrite gets applied.

I think that the 'P' flag is causing this NOT to happen, but I require this to be a proxied request, since the browser from which the request initiates will not respond favorably to a response from a different uri than the request went to.


share|improve this question
up vote 2 down vote accepted

One way to do it (I am sure there are simpler ways... but) is you can basic auth to the first box normally e.g.

And then generate the required Authorization header with something like this;

<Location /api/service>
Order Deny,Allow
Allow from All
#echo username:password | base64
 RequestHeader set Authorization "Basic ZmFzZ11fef1111111NlbnlpcAo"

and used this command to generate the base64 hash;

 echo username:password | base64
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.