The http-basic-authentication tag has no wiki summary.
6
votes
2answers
17k views
Can you pass user/pass for HTTP Basic Authentication in URL parameters?
I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere.
I tried ...
5
votes
4answers
3k views
Respond to HTTP OPTIONS with basic auth
We have a web site hosting Office documents behind IIS6 Basic authentication.
IE has an authentication token for basic auth, which it presents to download the file. The user clicks "Open", and then ...
5
votes
2answers
327 views
How do I secure a .NET (MVC) website prior to launch?
I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it ...
3
votes
1answer
442 views
Nginx PHP-FPM Basic Auth
I have nginx with php-fpm installed on Debian Squeeze.
Directory tree is:
/var/www/mysite
index.php
secret_folder_1
admin.php
static.html
secret_folder_2
admin.php
static.html
pictures
...
3
votes
4answers
823 views
Basic Auth on DirectoryIndex Only
I am trying to configure basic auth for my index file, and only my index file. I have configured it like so:
<Files index.htm>
Order allow,deny
Allow from all
AuthType Basic
...
3
votes
1answer
625 views
Excluding the nagios directory from Basic Auth that is set for the root directory
I have basic auth from the root directory for Apache. I am setting it like so.
/etc/httpd/conf.d/xxxx.conf
<Location />
AuthType Basic
AuthUserFile xxxxxxxx
AuthName "Restricted ...
3
votes
1answer
303 views
How can I stop brute force with IIS6 basic http authentication?
Is there a way to restrict incorrect login attempts and add some sort of timeout to stop basic auth being brute forced, using IIS?
3
votes
2answers
2k views
IIS Basic Authorization ala .htaccess/.htpasswd in apache
How do I implement the protection of the pages (asp.net mvc app), so when I hit the home page or any other pages within the application I get a login dialog popup in the browser
I'm looking for ...
3
votes
4answers
3k views
IIS 7.5 basic authentication and Active Directory validation
I'm not an IIS or Active Directory expert by any means so I want to present a scenario here and see if what we want to accomplish is feasible.
We have an application hosted on Windows Server 2008 R2 ...
3
votes
2answers
924 views
Apache redirect to https for basic auth
I have a tricky variation on an old problem.
I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication ...
3
votes
1answer
268 views
Slow Performance With IIS Basic Authentication
I'm using SSAS through HTTP with MSMDPUMP.dll. I have setup the MSMDPUMP.dll web to use only Basic Authentication and then I provide the User Id and Password in the ConnectionString. Everything works ...
3
votes
2answers
9k views
service static files under nginx & HTTP-Authentication
I have an app deployed in testing mode on a server. Access to it has been restricted to a select group of users via HTTP-Authentication. That works fine. The problem is that if I serve static files ...
2
votes
1answer
403 views
Limiting the number of basic authentication attempts in Apache
I'm using HTTPS + Basic authentication to protect a resource. How can I throttle authentication attempts to protect against brute force attacks?
2
votes
2answers
271 views
CentOS Apache: basic auth returning 403 instead of 401
I have three dirs in /var/www/html, one of them has .htacces with following:
Order Allow, Deny
Allow from all
AuthUserFile /var/www/.htpasswd
AuthGroupFile /dev/null
AuthName 'lalalal'
AuthType Basic
...
2
votes
4answers
601 views
Lock down Wiki access to password only but remain open to a subnet via .htaccess
Basically we have a Wiki that has some sensitive information stored in it - not the best I know but my predecessor set it up. I want to be able to request password access from any one who is not on ...
2
votes
1answer
353 views
How do I create a virtual host with basic HTTP auth?
This is what I have so far:
<VirtualHost *:80>
DocumentRoot "/PathToTheFilesThat/theserver/gives/access/to"
ServerName docs.mysite.com
ProxyPass / http://localhost:8808/
ProxyPassReverse / ...
2
votes
1answer
644 views
NGINX basic auth only for POST
I'm settings up nginx to serve Mercurial repositories. It works when not using basic authentication at all, or when I use basic authentication all over.
What I want to do is to just use basic auth on ...
2
votes
1answer
759 views
Where to set username/password for BASIC authentication in IIS7
I have a .net web app running on iis7 (windows 2008) and want to add some simple protection to it.
I've managed to set up BASIC authentication, but cant work out where I set the username/passwords ...
2
votes
1answer
842 views
How can I protect a Tomcat webapp that's reverse proxied in an Apache2 virtual host using basic authentication?
I'm having trouble figuring out how to adding basic HTTP authentication to password-protect a development testing environment running on a production web server. Both the main site and the testing ...
2
votes
1answer
625 views
Apache and mod_dbd Getting “DBD: mod_dbd not compatible with APR in get_driver”
Im tring to implement basic authentication with Apache server and plugin's
the proxy part working great but when i try to preform request that suppose to trigger the
mod_authn_dbd and its ...
2
votes
1answer
211 views
Found special user in apache weblog called @^Y@.@{phqsp~{2'/2|pq{jvk@-1('@lvo)&1--1.(/1)'@./*
When checking the logfiles of some of my customers I found this as username for authenticated users. We have a .htusers file used for basic web auth, all other users in the serverlog I found in the ...
2
votes
1answer
171 views
CUPS basic auth error through web interface
I'm trying to configure CUPS to allow remote administration through the web interface. There's enough documentation out there that I can figure out what to change in my cupsd.conf (changing Listen ...
2
votes
0answers
183 views
Nginx as a proxy doesn't allow to access backend (Apache) content which is password protected
I have apache as a backend and nginx as a frontend. Some content is password-protected by Apache (HTTP Auth).
When I access it directly - everything works fine, bur when I try it through nginx - ...
2
votes
1answer
554 views
How can I enable http auth in lighttpd for all directories except one?
I am trying to authenticate access to everything in webroot (/) except anything that resides in a particular directory (/directory/) and I've tried both of these options to no avail:
$HTTP["url"] =~ ...
1
vote
2answers
306 views
http basic auth using .htacces/.htpasswd allowing slightly incorrect passwords
I've got a few sites with directories protected by http basic auth implemented via .htaccess files paired with .htpasswd files. I've noticed that with a password ending in "et!" I can get in by ...
1
vote
3answers
648 views
apache basic authentication - how to disable on dev computer
I'm disabling access to some folders to unauthorized users this way:
AuthUserFile /var/www/passwords/.htpasswd_private
AuthType Basic
AuthName "Access to private admin section"
Require valid-user
...
1
vote
1answer
136 views
Does basic authentication allow multiple users to login with the same username and password?
Using IIS 6 or 7, does basic auth allow two people to use the same username/password combination to access the site simultaneously?
1
vote
2answers
67 views
apache AuthBasic denying correct login
I created a vhost in apache with this config
Alias /my /srv/my
<Location /my>
AuthType basic
AuthName "private area"
AuthBasicProvider file
AuthUserFile ...
1
vote
3answers
207 views
Update saved password for basic authentication using a script
I have a website that uses basic authentication as described on this webpage.
Each of the computers I manage have the password saved in their browser.
There is only one username and password for ...
1
vote
3answers
933 views
Prevent AD account lock when using basic authentication
I want to setup basic authentication on a virtual directory (in IIS6). It looks as if a malicious user can use the dialog (uid/pwd challenge) to try and login with a domain account and lock this ...
1
vote
4answers
118 views
.htaccess issue on Apache Web Server in Ubuntu VM
I just installed Apache Web Server on Ubuntu 11.04 in VMWare Workstation. I created a basic HTML page, named it index.html and placed it in /var/www directory (document root).
I am able to access ...
1
vote
1answer
139 views
How do I use my own web form with the ngx_http_auth_basic_module?
I want to capture the username and password with my own form and then use those values with the Nginx ngx_http_auth_basic_module,rather than having the default Nginx box that comes up, asking for ...
1
vote
2answers
185 views
apache2: Require valid-user AND allow all
I want to allow basic authentication, but not require it. All visitors -authenticated or not- should be able to acces a page (script) where the script can add special features for valid users.
So ...
1
vote
1answer
789 views
Rewriting a query-string part as a path part using nginx?
How do I rewrite URIs of the form
/one/two?path=three&foo=bar
to
/one/two/three?foo=bar
using nginx?
1
vote
1answer
882 views
Catching url parameters( “?=” or “&=” ) with Apache LocationMatch
I couldn't think of a good title for this.
Basically I have basic auth that covers the whole site from /, but I want urls with certain parameters to be excluded from authentication.
Example: do not ...
1
vote
3answers
287 views
iis' basic authentication system blocks too many login attempts?
I'm doing a security analysis of a network for a university project. The servers use the basic autentication of iis, integrated with ssl. I'm now considering the possibility of a bruteforce attack. I ...
1
vote
2answers
901 views
IIS7 How-To : Basic Folder Authentication
i am really lost with this problem and im hoping someone can help me out with some good old fashioned instructions.
i was able in windows 2003 to setup a folder on our webserver so when navigating to ...
1
vote
1answer
219 views
How is using client certificates more secure than TLS plus basic authentication?
I've read that securing services with client certificates is more secure than using the combination of TLS with basic authentication.
Client certificates have substantial drawbacks in terms of ...
1
vote
2answers
111 views
Apache removes Authorization header
Apache is acting as a reverse proxy in my setup.
The application server running on port 8081 requires a valid Authorization header.
The header is set by the client application.
Apache seems to remove ...
1
vote
1answer
134 views
Basic Auth URL Parsing [closed]
We have a new b2b vendor that wants to use basic auth via URL.
They want to authenticate like this:
//URL coming into our server
...
1
vote
1answer
58 views
Directory Security failing with Chrome Browser
I have a directory that is protected: (extract from the vhost conf file)
<Directory "/var/www/protectedDir">
allow from all
Options -Indexes
AuthName "secure data"
...
1
vote
1answer
332 views
NGINX basic auth timeout?
I've protected a directory with satisfy and basic_auth, but seems that the validation is not stored in a cookie which after some time it's deleted, seems it's ip or something based. So i login once ...
1
vote
1answer
261 views
mercurial hgwebdir error with basicauth in apache2
I'm having kind of a strange error that I'm trying to track down. I was trying to setup mercurial on my home server this weekend. I seem to have it running up to the point where I'm trying to get ...
1
vote
1answer
685 views
squid closes the connection when presented with “401 Unauthorized”
This is the conversation:
==> GET http://xy/z HTTP/1.1
<== HTTP/1.0 401 Unauthorized / Proxy-Connection: close
When bypassing Squid (squid/3.0.STABLE6), I get the HTTP basic authentication ...
1
vote
1answer
2k views
basic authentication with domain accounts on Windows Server 2008
A very weird issue that never encountered with Windows Server 2003: when configuring basic authentication to restrict access to specific directories in IIS7 I've done the following:
Enabled basic ...
1
vote
0answers
55 views
Apache Basic Auth not working in customer network
I'm having trouble, letting a customer see a site that is locked with a simple Apache Basic Auth password file.
It works in every browser on Mac, Windows and in our network. Even the customer get's ...
1
vote
2answers
67 views
password protect only the home page
I'm trying to pwd protect only my home page with apache basic auth.
This seems to work on everything not just the hp
<LocationMatch "/">
AuthType Basic
AuthName "heelooo?"
AuthUserFile ...
1
vote
1answer
153 views
Enable basic authentication in IIS for remote requests, but not for local ones?
Is there a way in IIS to enable basic authentication for remote requests while leaving the website open for local requests? I need external users to authenticate to access a site, but users on the ...
1
vote
0answers
84 views
Basic auth in IIS7 without impersonation
I have an IIS 7 site set up with its own app pool. The app pool is running as a specific user, and the site is set to run as the app pool identity.
I want to add basic-auth style protection to the ...
1
vote
2answers
228 views
Apache basic HTTP authentication not working
Trying to setup basic HTTP authentication with Apache, but it's not working. I get the directory listing and files regularly, no authentication required. I tried restarting httpd and the browsers ...
