I'm configuring Apache in front of Hawtio - a Karaf-hosted JVM management console. Although Hawtio is served by Jetty and protected by Karaf's JAAS implementation, we want Apache to add Basic Auth that we can then additionally secure it - e.g. from brute force attacks with Fail2Ban.

However, despite following advice such as this and this, Apache's basic auth keeps popping up rather than asking for the credentials once only. Hawtio's log-in page loads after two requests for credentials but then, once you've put in the Hawtio log-in details, Apache keeps popping up its log-in page. I've even gone as far as entering the credentials twenty times but it still asks for more!

Am I missing something obvious?

Here's my config:-

<VirtualHost *:80>
  ServerAdmin admin@localhost
  ServerName hawtio.mydomain.com

  ErrorLog ${APACHE_LOG_DIR}/error.log
  LogLevel warn

  CustomLog ${APACHE_LOG_DIR}/access.log combined

  # suppress rule checking for Hawtio stuff
  SecRuleRemoveById 950901 960010 970003 970014 981257 981318 981407 981205 981222 981240 981220

  <Location />
    ProxyPass http://application-server:8765/
    ProxyPassReverse http://application-server:8765

    AuthUserFile /etc/users
    AuthName "Restricted area"
    AuthGroupFile /dev/null 
    AuthType Basic
    Require valid-user

    RequestHeader unset Authorization


I've tried numerous variations including with the <Proxy> group rather than <Location /> but to no avail. As per this post, I added RequestHeader unset Authorization to see if it was Jetty that was complaining but neither the presence nor the absence of that directive makes a difference.

The site works perfectly if I remove the basic auth directives.

Thanks for any pointers.

  • Is it sending a new 401 to the client each time? Is the client sending the credentials in each request's headers? Jan 4, 2014 at 8:42
  • Hi Shane - thanks for the reply. I've put Wireshark on it, and in the detail it shows a 401 being demanded and the credentials then being passed back to the server once I've typed them in. NB the client in this case is Google Chrome. J. Jan 4, 2014 at 16:29
  • PS. sorry, to be clear, it's demanding a 401 multiple times. Jan 4, 2014 at 16:58
  • Are the subsequent 401s on the request for the same resource? In other words, is it GET / -> 401 -> GET / with authorization -> 401 -> GET / with authorization again -> 200? Or are the subsequent 401s occurring on requests for other resources? Jan 4, 2014 at 21:04
  • Hi Shane - each request is for a different resource. Is my expectation that one authorisation will cover all matching resources incorrect? Jan 6, 2014 at 12:50

1 Answer 1


You need to set a cookie or cache the credentials some how. I've seen this when configuring Apache with one-time passcodes. mod_auth_radius supports AuthRadiusCookieValid. Not sure what you would use here.

  • Thanks - I've come to the conclusion that the basic auth directives are simply not going to work in my case, so I'll bite the bullet and look into certs, RADIUS, etc. Jan 20, 2014 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .