The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
2answers
713 views

Apache2 mix of two location restrictions: basic auth and ip-based

I want to restrict a staging server with basic auth, except for one special location, which should not have basic auth but be restricted to a client IP block. My virtual host section looks like this: ...
1
vote
1answer
614 views

Basic authentication not occurring to a remote machine on IIS7

I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic ...
1
vote
1answer
299 views

mercurial hgwebdir error with basicauth in apache2

I'm having kind of a strange error that I'm trying to track down. I was trying to setup mercurial on my home server this weekend. I seem to have it running up to the point where I'm trying to get ...
1
vote
1answer
313 views

How is using client certificates more secure than TLS plus basic authentication?

I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication. Client certificates have substantial drawbacks in terms of ...
0
votes
1answer
526 views

mod_auth wrong password authentication?

i have a server running apache2 in a debian lenny. something strange happen with the folders protected by .htaccess. basically, if you put a wrong password but formed by the_correct_password + ...
0
votes
1answer
2k views

Apache, Tomcat 5 and problem with HTTP basic auth

I have setup a Tomcat with a webapp that uses http basic auth in some of its URLs. There is a Apache server in front of the Tomcat. I have setup Apache as a proxy like this (all traffic should go ...
5
votes
2answers
594 views

How do I secure a .NET (MVC) website prior to launch?

I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it ...
0
votes
2answers
2k views

IIS7: Allow users to identify themselves with either “Windows Authentication” or “Basic Authentication” on the same file

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7? What I want is: Someone calls webservice If possible, use windows authentication (e.g. ...
0
votes
2answers
974 views

Dynamic AuthUserFile in apache with mod_rewrite. Is it possible?

I've got a server with several scponly accounts and I want to provide http access under Basic Auth. The first part of the problem is solved, using mod_rewrite to chop and select the right directory ...
1
vote
2answers
521 views

http basic auth using .htacces/.htpasswd allowing slightly incorrect passwords

I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by ...
0
votes
1answer
413 views

Allow website access from specific subnet, otherwise ask for credentials

How can I configure IIS 6 to allow access to a sub folder from our intranet without any authentication (well, the IP address needs to be checked but that's already working) from the internet only ...
0
votes
1answer
673 views

Protect all XML-RPC calls with HTTP basic auth but one

I set up a Django project for smartphone serving XML-RPC methods over HTTPS and using basic auth. All XML-RPC methods require username and password. I would like to implement a XML-RPC method to ...
0
votes
2answers
122 views

Does using Apache Basic Auth affect yum installations?

I don't have further information yet, but I am going to be troubleshooting this in the morning and I wanted to get a head-start. Is there any reason that a yum install (that worked fine yesterday) ...
5
votes
1answer
2k views

NGINX basic auth only for POST

I'm settings up nginx to serve Mercurial repositories. It works when not using basic authentication at all, or when I use basic authentication all over. What I want to do is to just use basic auth on ...
3
votes
3answers
2k views

Apache redirect to https for basic auth

I have a tricky variation on an old problem. I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication (...
1
vote
1answer
1k views

squid closes the connection when presented with “401 Unauthorized”

This is the conversation: ==> GET http://xy/z HTTP/1.1 <== HTTP/1.0 401 Unauthorized / Proxy-Connection: close When bypassing Squid (squid/3.0.STABLE6), I get the HTTP basic authentication prompt,...
0
votes
1answer
100 views

Weird htaccess file

I am working on a client's site, and I spot this htaccess file. # -FrontPage- IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti* <Limit GET POST> order deny,allow deny from all ...
0
votes
1answer
701 views

Root URL forces IE to “HTTP BASIC” authentication mode?

I have a RoR app that has worked fine for quite some time, but after a recent deployment, all of the IE users in the office have been presented with a IE username and password popup dialog when they ...
1
vote
1answer
3k views

basic authentication with domain accounts on Windows Server 2008

A very weird issue that never encountered with Windows Server 2003: when configuring basic authentication to restrict access to specific directories in IIS7 I've done the following: Enabled basic ...
2
votes
1answer
524 views

Limiting the number of basic authentication attempts in Apache

I'm using HTTPS + Basic authentication to protect a resource. How can I throttle authentication attempts to protect against brute force attacks?
2
votes
4answers
668 views

Lock down Wiki access to password only but remain open to a subnet via .htaccess

Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on ...
3
votes
2answers
11k views

service static files under nginx & HTTP-Authentication

I have an app deployed in testing mode on a server. Access to it has been restricted to a select group of users via HTTP-Authentication. That works fine. The problem is that if I serve static files ...
0
votes
2answers
828 views

apache basic auth require group not throing forbidden

i have a basic auth setuped with user and groups AuthType Basic AuthName "GSD Dev Area" AuthUserFile /coding/conf/passwords/gsdesign/htpasswd AuthGroupFile /coding/conf/passwords/gsdesign/groups ...
5
votes
4answers
5k views

Respond to HTTP OPTIONS with basic auth

We have a web site hosting Office documents behind IIS6 Basic authentication. IE has an authentication token for basic auth, which it presents to download the file. The user clicks "Open", and then ...