I am trying to reverse proxy a web site with apache httpd 2.2 on centos 6. Access to part of that site should be restricted via basic auth. To that end, I have the following config:
<Location ~ "(/ac/sd|/myapp/pages)"> AuthType Basic AuthName "Restricted area" AuthBasicProvider file AuthUserFile "/etc/httpd/passwords" Require valid-user </Location> # restricted area ProxyPass /ac/sd/pages/UI.php http://myapp-test.acme.org:8000/myapp/pages/UI.php ProxyPassReverse /ac/sd/pages/UI.php http://myapp-test.acme.org:8000/myapp/pages/UI.php ProxyPass /ac/sd/pages/logoff.php http://myapp-test.acme.org:8000/myapp/pages/logoff.php ProxyPassReverse /ac/sd/pages/logoff.php http://myapp-test.acme.org:8000/myapp/pages/logoff.php ProxyPass /ac/sd http://myapp-test.acme.org:8000/myapp ProxyPassReverse /ac/sd http://myapp-test.acme.org:8000/myapp ProxyPass /myapp/pages http://myapp-test.acme.org:8000/myapp/pages ProxyPassReverse /myapp/pages http://myapp-test.acme.org:8000/myapp/pages # unrestricted area ProxyPass /ac/pages/UI.php http://myapp-test.acme.org:8000/myapp/portal/index.php ProxyPassReverse /ac/pages/UI.php http://myapp-test.acme.org:8000/myapp/portal/index.php ProxyPass /ac/pages/logoff.php http://myapp-test.acme.org:8000/myapp/portal/logoff.php ProxyPassReverse /ac/pages/logoff.php http://myapp-test.acme.org:8000/myapp/portal/logoff.php ProxyPass /ac/portal http://myapp-test.acme.org:8000/myapp/portal ProxyPassReverse /ac/portal http://myapp-test.acme.org:8000/myapp/portal ProxyPass /ac http://myapp-test.acme.org:8000/myapp ProxyPassReverse /ac http://myapp-test.acme.org:8000/myapp ProxyPass /portal http://myapp-test.acme.org:8000/myapp/portal ProxyPassReverse /portal http://myapp-test.acme.org:8000/myapp/portal
The reverse proxy part is working, i have tested without the auth. Also the auth part is working, I have tested with a simple index.html that is not proxied but resides on the server that the above config is taken from.
Now what is not working is the authentication together with the reverse proxy. What happens is that when I try to access the site with a webbrowser, the popup asking for authentication appears, with "Restriced area" as part of the popup text. I enter the credentials, and after a short moment, without loading any content, the credential pop up appears again, this time with "myapp" in the pop up text. No matter what I enter in there, it keeps popping up again. So it seems that the first auth succeeded, but for some reason the proxied site sends another basic auth. That might be my missinterpretation - I do not really understand what is going on here.
I also tried to use an almost identical config to reverse proxy a python simpleHTTPServer. There the reverse proxy and authentication worked. So it seems there is something with my application together with proxying or authentication going on. Still, if there is no basic auth in the application, why does it keep popping up?