1

TL'DR

set a gibberish URL in nginx site definition that would bypass basic-auth to reverse-proxy

More details:

I have a setup with Grafana running on a VPS and an nginx reverse proxy directing towards it behind basic auth. The setup works fine but it's cumbersome to access it from mobile devices having to enter username and password all the time.

I was thinking about keeping the existing setup for regular access but also creating a URL that should not be easily guessed which would allow direct access to Grafana such that I should be able to bookmark the unprotected URL on the phone and access it without user/pw.

I read all the questions on this matter but I'm still required to enter user/pw so I may be doing something wrong.

My current setup, after reading all related questions looks like this:

  server {
      listen 80;
 
      server_name grafana.some.tld;
      auth_basic_user_file /etc/nginx/htpasswd.users;
      
        location  /q874gg#11CM2j/ {
          auth_basic "off";
          allow all;
          proxy_redirect off;
          proxy_pass http://127.0.0.1:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection 'upgrade';
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
      }
 
      location / {
          auth_basic "Restricted Access";
          proxy_pass http://127.0.0.1:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection 'upgrade';
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
      }
 
}

Basically the 2 locations should be identical except for the auth_basic directive. What I presented above is the combined result of what I've read so far.

Probably there are some redirects that go outside my "hidden" location and hit the protected one?

Additional question: is this a good way to achieve unprotected access from mobile phone? I cannot use IP filtering as it's dynamic, also VPN is cumbersome for just a quick view to my dashboards.

Any help greatly appreciated!

6
  • setup wireguard takes less as 10 minutes and you won't need to create such a workaround.
    – djdomi
    Aug 29, 2022 at 17:34
  • 1
    agreed, but it is still cumbersome to connect to VPN just to see a dashboard whenever you feel the need or when you get an alert. I am looking for a simpler method, like having a shortcut on the phone's home screen. Any idea how can I achieve that with nginx?
    – bosch
    Sep 9, 2022 at 11:47
  • which tls is in use? because some have a forced hsts
    – djdomi
    Sep 9, 2022 at 17:32
  • no tls in use. It was a pet project that I kept growing and now it becomes of more importance
    – bosch
    Sep 9, 2022 at 18:03
  • I'm sorry, what TLD is involved. Damn auto correction
    – djdomi
    Sep 9, 2022 at 18:04

0

You must log in to answer this question.