The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
163 views

HTTP Status Codes for Web Application Logic

This might be more of a PHP and SO question, but since it deals with HTTP codes, I thought I'd ask here first. So I'm building a very simple user authentication backend that basically checks the ...
0
votes
1answer
1k views

How to exclude a specific URL from basic authentication in Apache?

Two scenarios: Directory I want my entire server to be password-protected, so I included this directory config in my sites-enabled/000-default: <Directory /> Options FollowSymLinks ...
53
votes
4answers
218k views

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere. I tried ...
1
vote
3answers
304 views

Update saved password for basic authentication using a script

I have a website that uses basic authentication as described on this webpage. Each of the computers I manage have the password saved in their browser. There is only one username and password for ...
1
vote
2answers
481 views

apache2: Require valid-user AND allow all

I want to allow basic authentication, but not require it. All visitors -authenticated or not- should be able to acces a page (script) where the script can add special features for valid users. So ...
1
vote
0answers
105 views

Basic auth in IIS7 without impersonation

I have an IIS 7 site set up with its own app pool. The app pool is running as a specific user, and the site is set to run as the app pool identity. I want to add basic-auth style protection to the ...
2
votes
1answer
921 views

How do I create a virtual host with basic HTTP auth?

This is what I have so far: <VirtualHost *:80> DocumentRoot "/PathToTheFilesThat/theserver/gives/access/to" ServerName docs.mysite.com ProxyPass / http://localhost:8808/ ProxyPassReverse / ...
1
vote
3answers
2k views

apache basic authentication - how to disable on dev computer

I'm disabling access to some folders to unauthorized users this way: AuthUserFile /var/www/passwords/.htpasswd_private AuthType Basic AuthName "Access to private admin section" Require valid-user ...
4
votes
1answer
2k views

How can I protect a Tomcat webapp that's reverse proxied in an Apache2 virtual host using basic authentication?

I'm having trouble figuring out how to adding basic HTTP authentication to password-protect a development testing environment running on a production web server. Both the main site and the testing ...
3
votes
4answers
14k views

IIS 7.5 basic authentication and Active Directory validation

I'm not an IIS or Active Directory expert by any means so I want to present a scenario here and see if what we want to accomplish is feasible. We have an application hosted on Windows Server 2008 R2 ...
0
votes
1answer
1k views

nginx shows 403 after http auth successful when proxying

I have a basic sinatra app which is behind nginx so that I can use HTTP Basic Auth to protect it, but I get a 403 Forbidden error instead of seeing the webapp. The app works fine when I remove the ...
3
votes
1answer
1k views

Nginx PHP-FPM Basic Auth

I have nginx with php-fpm installed on Debian Squeeze. Directory tree is: /var/www/mysite index.php secret_folder_1 admin.php static.html secret_folder_2 admin.php static.html pictures ...
2
votes
2answers
2k views

Apache basic HTTP authentication not working

Trying to setup basic HTTP authentication with Apache, but it's not working. I get the directory listing and files regularly, no authentication required. I tried restarting httpd and the browsers ...
6
votes
2answers
16k views

Enable basic auth sitewide and disabling it for subpages?

I have a relatively straight forward config: upstream appserver-1 { server unix:/var/www/example.com/app/tmp/gunicorn.sock fail_timeout=0; } server { listen 80; server_name example.com; ...
2
votes
1answer
798 views

NGinx proxy, adding a basic authentication based on ip address

I’m building a system based on OpenVPN, where clients will connect to a website, secured by Basic Authentication (that’s the way it is, no way to change this). I wish I could go through a nginx ...
0
votes
1answer
259 views

Apache HTTP-Basic Auth not working

I have a really simple authorization configuration, but I'm getting a weird message rather than a user/password field when I try to access the page. Here's my .htaccess file: AuthType basic AuthName ...
2
votes
1answer
3k views

Rewriting a query-string part as a path part using nginx?

How do I rewrite URIs of the form /one/two?path=three&foo=bar to /one/two/three?foo=bar using nginx?
2
votes
1answer
1k views

Apache and mod_dbd Getting “DBD: mod_dbd not compatible with APR in get_driver”

Im tring to implement basic authentication with Apache server and plugin's the proxy part working great but when i try to preform request that suppose to trigger the mod_authn_dbd and its ...
0
votes
1answer
103 views

Apache 2+ basic authentication from db , not from files how to?

what plugins and what configuration do i need to configure Apache server to use user/password from DB and not from files to preform basic authentication
1
vote
1answer
2k views

Catching url parameters( “?=” or “&=” ) with Apache LocationMatch

I couldn't think of a good title for this. Basically I have basic auth that covers the whole site from /, but I want urls with certain parameters to be excluded from authentication. Example: do not ...
1
vote
0answers
371 views

Basic authentication with IIS 7 reverse proxy

In our DMZ we currently have a facade or proxy web page (asp.net webform), which forwards requests to a web service (asp.net web service) in our intranet, then relays the web services response back to ...
0
votes
1answer
495 views

IIS/AD - Implementing single sign-on between two websites

I have two websites. One is an "intranet," one is a public site that has "admin" areas: www.example-intranet.com www.example.com They are both running on the same IIS 6 box. ...
1
vote
2answers
2k views

NGINX basic auth timeout?

I've protected a directory with satisfy and basic_auth, but seems that the validation is not stored in a cookie which after some time it's deleted, seems it's ip or something based. So i login once ...
3
votes
1answer
432 views

How can I stop brute force with IIS6 basic http authentication?

Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
1
vote
1answer
524 views

Does basic authentication allow multiple users to login with the same username and password?

Using IIS 6 or 7, does basic auth allow two people to use the same username/password combination to access the site simultaneously?
3
votes
4answers
2k views

Basic Auth on DirectoryIndex Only

I am trying to configure basic auth for my index file, and only my index file. I have configured it like so: <Files index.htm> Order allow,deny Allow from all AuthType Basic ...
4
votes
2answers
6k views

IIS Basic Authorization ala .htaccess/.htpasswd in apache

How do I implement the protection of the pages (asp.net mvc app), so when I hit the home page or any other pages within the application I get a login dialog popup in the browser I'm looking for ...
1
vote
1answer
822 views

How can I use munin-node apache_ with basic authentication?

munin-node-configure --suggest tells me that the apache_* nodes cannot be used: apache_accesses | no | no [Port 80: Authorization Required] apache_processes | no | no ...
4
votes
1answer
3k views

Where to set username/password for BASIC authentication in IIS7

I have a .net web app running on iis7 (windows 2008) and want to add some simple protection to it. I've managed to set up BASIC authentication, but cant work out where I set the username/passwords ...
0
votes
1answer
2k views

PAM authentication failure with HTTP Basic auth and mod_auth_pam on Apache

I'm trying to set up HTTP Basic auth with PAM on Apache (running on Ubuntu 10.04). I have a VirtualHost setup with SSL and the options below for HTTP Basic authentication: AuthBasicAuthoritative off ...
0
votes
1answer
2k views

IIS 7.5 Basic authorization issue

When I log on using correct user name\password (I always copy-paste them) I get 401.1 error. User name and password are correct (user is created on server locally, not a domain one). I can run program ...
1
vote
2answers
77 views

apache AuthBasic denying correct login

I created a vhost in apache with this config Alias /my /srv/my <Location /my> AuthType basic AuthName "private area" AuthBasicProvider file AuthUserFile ...
1
vote
3answers
577 views

iis' basic authentication system blocks too many login attempts?

I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
0
votes
1answer
2k views

basic auth across multiple subdomains

I'm setting up a basic test environment to test drive multiple sites I co-maintain with a colleague. What I am trying to achieve is to password protect the entire domain with basic auth. This is ...
2
votes
2answers
1k views

IIS7 How-To : Basic Folder Authentication

i am really lost with this problem and im hoping someone can help me out with some good old fashioned instructions. i was able in windows 2003 to setup a folder on our webserver so when navigating to ...
1
vote
3answers
2k views

Prevent AD account lock when using basic authentication

I want to setup basic authentication on a virtual directory (in IIS6). It looks as if a malicious user can use the dialog (uid/pwd challenge) to try and login with a domain account and lock this ...
3
votes
1answer
947 views

Excluding the nagios directory from Basic Auth that is set for the root directory

I have basic auth from the root directory for Apache. I am setting it like so. /etc/httpd/conf.d/xxxx.conf <Location /> AuthType Basic AuthUserFile xxxxxxxx AuthName "Restricted ...
5
votes
1answer
2k views

How can I enable http auth in lighttpd for all directories except one?

I am trying to authenticate access to everything in webroot (/) except anything that resides in a particular directory (/directory/) and I've tried both of these options to no avail: $HTTP["url"] =~ ...
1
vote
0answers
433 views

Prevent Authentication Prompt When Streaming Office Documents

I have an issue where when streaming office documents from SQL Server, an authentication dialog prompts for credentials even though the user has been authenticated via basic auth in the browser. ...
0
votes
2answers
684 views

Apache2 mix of two location restrictions: basic auth and ip-based

I want to restrict a staging server with basic auth, except for one special location, which should not have basic auth but be restricted to a client IP block. My virtual host section looks like this: ...
1
vote
1answer
601 views

Basic authentication not occurring to a remote machine on IIS7

I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic ...
1
vote
1answer
298 views

mercurial hgwebdir error with basicauth in apache2

I'm having kind of a strange error that I'm trying to track down. I was trying to setup mercurial on my home server this weekend. I seem to have it running up to the point where I'm trying to get ...
1
vote
1answer
306 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
0
votes
1answer
486 views

mod_auth wrong password authentication?

i have a server running apache2 in a debian lenny. something strange happen with the folders protected by .htaccess. basically, if you put a wrong password but formed by the_correct_password + ...
0
votes
1answer
1k views

Apache, Tomcat 5 and problem with HTTP basic auth

I have setup a Tomcat with a webapp that uses http basic auth in some of its URLs. There is a Apache server in front of the Tomcat. I have setup Apache as a proxy like this (all traffic should go ...
5
votes
2answers
580 views

How do I secure a .NET (MVC) website prior to launch?

I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it ...
0
votes
2answers
2k views

IIS7: Allow users to identify themselves with either “Windows Authentication” or “Basic Authentication” on the same file

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7? What I want is: Someone calls webservice If possible, use windows authentication (e.g. ...
0
votes
2answers
925 views

Dynamic AuthUserFile in apache with mod_rewrite. Is it possible?

I've got a server with several scponly accounts and I want to provide http access under Basic Auth. The first part of the problem is solved, using mod_rewrite to chop and select the right directory ...
1
vote
2answers
510 views

http basic auth using .htacces/.htpasswd allowing slightly incorrect passwords

I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by ...
0
votes
1answer
407 views

Allow website access from specific subnet, otherwise ask for credentials

How can I configure IIS 6 to allow access to a sub folder from our intranet without any authentication (well, the IP address needs to be checked but that's already working) from the internet only ...