2

This may be a really dumb question but I had to make sure that i'm fine with this.

I setup an HTTPS server with basic auth, but the browser informs me that the connection is not secured when i connect to the auth page, and tells me that the connection is secured after i sign in. I want to know whether this is safe, and if not, how can i make it secured?

Config(NGINX):

server {
    listen 80;
    server_name sub.example.com;

    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name sub.example.com;

    ssl_ceerificate (certpath);
    ssl_certificate_key (certkeypath);
    ssl_trusted_certificate (anotherpath);
    ssl_dhparam (dhparam);

    ssl_protocols TLSv1.2 TLSv1.3;                                                                                                                                          
    ssl_prefer_server_ciphers on;                                                                                                                                           
    ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA25$
    ssl_ecdh_curve secp384r1;                                                                                                                                               
    ssl_session_timeout 10m;                                                                                                                                                
    ssl_session_cache shared:SSL:10m;                                                                                                                                       
    ssl_session_tickets off;                                                                                                                                                
    ssl_stapling on;                                                                                                                                                        
    ssl_stapling_verify on;                                                                                                                                                 

    add_header X-Content-Type-Options "nosniff" always;                                                                                                                     
    add_header X-Frame-Options "SAMEORIGIN" always;                                                                                                                         
    add_header X-XSS-Protection "1; mode=block"                                                                                                                                                            

    location / {                                                                                                                                                    
        auth_basic 'Nothing to see here';                                                                                                                                                                                                

        proxy_pass http://localhost:4000/;                                                                                                                     
    }
}

Screenshot

11
  • Do you have proper certificates installed? Aug 4 at 14:16
  • @TeroKilkanen yes I have a letsencrypt cert installed and chrome recognizes it too after i sign in
    – Jungroy
    Aug 4 at 14:18
  • Have you added the basic authentication to the encrypted host or to the unencrypted (port 80)? Please share your config file(s).
    – digijay
    Aug 4 at 14:48
  • @digijay every http request is redirected to https, thus basic auth is on https server, i'll share the config asap
    – Jungroy
    Aug 4 at 15:04
  • What is the real hostname? Aug 4 at 15:52
3

Your configuration appears fine; it's the browser that is misbehaving.

Your site correctly redirected to https, and the basic auth request was sent to you over https. But the browser did not update the address bar before popping up the dialog. Interestingly, I was able to see this behavior both on Chrome and Firefox. Perhaps this is because the browser asked for the credentials before (from its perspective) the page load was complete? It's a question for the browser developers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.