Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a server with apache set up as an authentication front end for a backend web service running on the same box.

The setup seemed to work at first, but we soon realised that apache was asking for authentication every time we clicked a link, went back or reloaded a page. We're now at a loss to resolve this.

Our apache2 virtual hosts file:

<VirtualHost *:80>

  ErrorLog /var/log/apache2/graphiti-error.log
  CustomLog /var/log/apache2/graphiti-access.log common

  <Location "/">
          require valid-user
          order allow,deny
          Allow from all
          AuthType Basic
          AuthName "Stats"
          AuthBasicProvider file
          AuthUserFile /etc/passwd_lp

  ProxyRequests off
  ProxyPreserveHost on
  ProxyPass / http://localhost:8080/
  ProxyPassReverse / http://localhost:8080/

  <Proxy *>
          Order allow,deny
          Allow from all


We're using Apache2 v2.2.22 on Ubuntu EC2 12.04

We have already tried; moving the Auth declarations into the <Proxy> block; setting ProxyRequests on; setting ProxyPreserveHost off.


share|improve this question
That sounds like it might be a client browser issue.. Is the browser not re-sending the authorization header with subsequent requests? Or is the hostname the client's accessing changing? – Shane Madden Dec 20 '12 at 5:38
Hi, we thought this too at first but it's happening with all browsers (FF, Chrome & Safari tested) and the hostnames are consistent.What we suspect to be happening is that Apache forwards the session to the proxy'd backend which does nothing with it. Therefore, every click or reload causes Apache to start a new session and ask for authentication. – nightowl Dec 20 '12 at 11:14
Basic authentication doesn't have any concept of 'sessions' - the client browser is responsible for sending the Authorization header with every request. Can you check if that's happening using Chrome's developer tools or Firebug? – Shane Madden Dec 20 '12 at 16:16
Thanks for the suggestions. Turns out this one has been a bit of a red herring. See my answer. – nightowl Dec 20 '12 at 17:21
up vote 1 down vote accepted

I have now solved this problem. It was nothing to do with Apache in the end (per se). Graphiti uses a JavaScript function to make HTTP requests to the Graphite service, which we had set up as a separate vhost, which also had Auth setup (some users prefer to use it directly).

So basically, no user/password were in the URL that graphite was using, and so every one triggered an Auth prompt. To fix it, we just needed to update our templates so that the URL generates with the http://<user>:<password>@<host> syntax.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.