1

I have a service running on port 3000. I successfully pointed an URL to the address using the following nginx directive:

server {
  listen   80;
  server_name notes.mydomain.foo;

  location / {
    proxy_pass http://localhost:3000;
  }  
  auth_basic "Get lost!";
  auth_basic_user_file /etc/nginx/.htpasswd;
}

That is, when someone goes to http://notes.mydomain.foo/, nginx successfully does its job of reverse-proxying the request to xxx.xxx.xxx.xxx:3000, and presents the user with a basic HTTP authentication request.

However, if I point the browser directly to xxx.xxx.xxx.xxx:3000, auth_basic is bypassed and anyone can access the content that should be restricted.

How can I enable auth_basic on either the public URL and the ip:port addresses?

  • 1
    Your edge firewall should block port 3000 – Drifter104 Aug 26 '16 at 9:51
  • @Drifter104 yup! With a couple of simple iptables rules the problem was solved. Much simpler... Thanks! – SeuMenezes Aug 26 '16 at 11:18
1

If you visit your site at

http://xxx.xxx.xxx.xxx:80

you will see the auth_basic response.

The service running on port 3000 should be reconfigured to not be publicly visible. Instead, it should only accept connections from nginx. This is a standard approach with proxies.

To do this, there should be a way in the service configuration to specify the listening IP address as well as the port (3000). Change or add to the configuration so that the listening IP address is 127.0.0.1, and restart the service.

  • I did this, but following @Drifter104 advice, that is, iptables-wise. Works nicely, thanks! – SeuMenezes Aug 26 '16 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.