Questions tagged [http-authentication]
The http-authentication tag has no usage guidance.
74
questions
2
votes
0
answers
67
views
Apache2 cannot get authentication to work
Running:
Apache 2.4.41 on Ubuntu 20.04
I am trying to force authentication on /var/www/html but I think I have tried every combination of options possible but every single time it lets people in with ...
- 21
0
votes
0
answers
43
views
Securing endpoints on Azure Application Gateway for access by HubSpot
We have a legacy system which presents a REST API that has Basic Authentication / this API has so far only been accessible from within our private network.
We've been asked to make this API available ...
- 1,214
1
vote
0
answers
118
views
Nginx auth_request ignored when accessing from non-auth_request location
I am trying to use a web app which allows me to upload and share files via a download link. I want the upload section to be accessed via authenticated users only, and download links to be accessible ...
- 11
0
votes
1
answer
146
views
Azure Function App - Azure Defender compliance
Azure Defender on Azure has two policies for Azure Function authentication that I'm not able to implement from other azure resources that support http calls.
Function apps should have Client ...
1
vote
1
answer
343
views
What is this formatting in the "Bearer" Authentication token of a HTTP get
I came across a "Bearer" Authentication in the header of a HTTP request (I want to understand an API) that I want to replicate.
This is the header field:
authentication : Bearer ...
- 113
1
vote
1
answer
676
views
Condition depending on domain in .htaccess: SetEnvIf and IfDefine?
I would like to add a rule in .htaccess that "Does something" (actually enable a httpauth user restriction) depending on the domain name.
I thought I had it and did:
<IfModule ...
- 115
1
vote
0
answers
606
views
Nginx basic_auth for entire site (reverse proxy) except for a "hidden" URL which should access all content without basic_auth
TL'DR
set a gibberish URL in nginx site definition that would bypass basic-auth to reverse-proxy
More details:
I have a setup with Grafana running on a VPS and an nginx reverse proxy directing towards ...
- 185
0
votes
1
answer
1k
views
NginX: how to rewrite response body and headers?
Context
I have a collection of static HTML pages (~10k pages) generated by some application over which I have no control. These pages are served by NginX from a location block.
Pages may contain ...
- 111
-1
votes
1
answer
49
views
How to make it so you only have to authenticate once for a group of subdomains using a Apache virtual host?
I have a Ubuntu 20.04 LTS Server with a set of virtual host configurations that protect a group of subdomains using basic auth, for example lets say secure.example.com is password protected as well as ...
0
votes
0
answers
362
views
nginx auth_basic stopped working
I had defined basic auth for nginx like this:
auth_basic "Login to access";
auth_basic_user_file /etc/nginx/httppwd;
It used to work fine until today when it stopped working without any ...
- 113
3
votes
0
answers
1k
views
How can I disable HTTP Basic Auth on my Apache instance for a specific REQUEST_URI
I have a linux instance hosting a WordPress site and it has Basic HTTP Auth enabled for the entire site. I now want to disable the Basic HTTP Auth for a specific path we can call /auth-free-url-2019.
...
- 31
0
votes
1
answer
58
views
Website authentication method? [closed]
Once, many years ago, I secured my website. I'm struggling to remember exactly what I did. I believe I generated a certificate (or a token???) that I delivered to a select few people I wanted to grant ...
- 103
3
votes
1
answer
7k
views
HTTP 'auth_basic' Error on NGINX
My code to secure the wp-login page is throwing an error:
nginx: [emerg] invalid number of arguments in "auth_basic" directive in /etc/nginx/conf.d/wordpress.conf:41
I am not sure what is ...
1
vote
1
answer
1k
views
Require a HTTP-authentication only for connections from outside my LAN in HAProxy
I have HAProxy configured to require a HTTP-authentication for a single frontend. It looks like this
userlist Users
group G1
user XXX password YYY
frontend public
bind :::80 v4v6
...
- 133
0
votes
1
answer
180
views
Unable to enroll Device into Azure AD using 3rd Party On-Premise MDM
We are in the process of Integrating a third party MDM (on-premise) with Autopilot in AAD portal to enable Windows 10 OOBE. We want to achieve this by leveraging an on-premise Core Enterprise ...
- 51
0
votes
1
answer
2k
views
Require basic auth for specific IPs in nginx
I have a whitelist of IPs for nginx, but in addition to this I want to require basic authentication for specific IP.
For example, allow access for these IPs:
198.51.100.1
198.51.100.2
require basic ...
- 276
1
vote
0
answers
2k
views
IIS responds with "401 Unauthorized" without waiting for request's body
I noticed that our IIS 8.5 returns "401 Unauthorized" response to non-authenticated HTTP request right after receiving its headers, without waiting for the body:
the client:
POST /some/protected/...
- 155
1
vote
2
answers
2k
views
Is it possible to truncate $remote_user in an nginx access log?
We have an nginx server that, in some contexts, receives sensitive data in the HTTP username field. More specifically, it's an API key that clients are sending like curl -u "$API_KEY:" ....
The ...
- 1,214
1
vote
1
answer
764
views
Rewrite then Basic Auth with Apache for Cloudfront
I have a website where all pages go through AWS Cloudfront (right now with a TTL of 0).
The site domain is www.example.com, which is a CNAME to the cloudfront distribution. Cloudfront then requests ...
- 121
0
votes
0
answers
1k
views
Apache mod_auth_form to subdirectory
First, my structure. Running Ubuntu 16.04.3 with Apache 2.4, I have a site at /mnt/WWW but never serves pages from there except for a login form. Everything is redirected to www. if not another ...
0
votes
0
answers
46
views
Automatic logins in chrome
I have an outdated internal website (which I cannot alter), which uses one of those old login mechanisms which pops up a modal authentication box when you try to access it.
(The popup is not HTML, but ...
- 111
0
votes
1
answer
1k
views
Cannot login into gerrit
I have a gerrit setup on my server with http as a authentication method and nginx as server. I've created a admin account which works perfectly fine. I was trying to set up a another account with ...
- 141
3
votes
0
answers
809
views
PKI Authentication in HTTPD using Active Directory (LDAP)
In my environment, an external entity provides a Root CA & Intermediate CA(s). They issue thousands of smartcards with PKI certificates for authentication. They provide the Client Authentication ...
- 131
2
votes
2
answers
2k
views
HTTP Authentication being ignored, both in .htaccess AND in httpd.conf
I have recently discovered that some of the development websites on my local computer (Windows 10/Apache 2.4) are visible from the web when they should not be. the problem is similar to this question, ...
- 211
2
votes
2
answers
828
views
Nginx, auth and forcing HTTPS - as an include snippet?
Got a bit stuck here. I'd like a nice simple Nginx "include"able snippet that requires HTTP AUTH for the location it is include-ed in, AND forces a redirect to HTTPS if not already.
I came up with ...
- 21
0
votes
2
answers
1k
views
Nginx forcing auth for IP in allowed subnet
I'm implementing authentication for the sites hosted inside the office, I have a PAM auth module that authenticates the users, that's working good so far.
The problem is that I need to authenticate ...
- 36
1
vote
1
answer
2k
views
Securing Kafka REST API endpoints
We plan to use Kafka for publishing updates to our customers. The plan is to use the dedicated topic for each client. To makes things simpler for them we want to utilize REST API. So that user1 will ...
- 113
3
votes
0
answers
1k
views
How to set up authentication server before request reach API server using HAProxy?
I want a set up that would force all requests to be authenticated before reaching the application server. I'm seeing HAProxy support basic HTTP Authentication but I couldn't find any info about making ...
- 131
6
votes
2
answers
2k
views
ngx_http_auth_request_module equivance for HAProxy
Does an equivalent module to nginx's ngx_http_auth_request_module exist for HAProxy or Apache? This module allows support for custom authentication through HTTP. I quote:
The ...
- 181
-2
votes
1
answer
1k
views
How to Specify which URLs have HTTP Authentication with NGINX
In my nginx configuration file I have successfully created HTTP Authentication for the whole website while it's under development.
root /var/www/staging/;
auth_basic "Restricted website - authorised ...
- 1,027
5
votes
3
answers
5k
views
Single sign on with Apache and LDAP
I have a server running two web applications: Gerrit and Mantis BT. Now, these applications connect to an LDAP server to authenticate users and it works fine. But the user has to authenticate for each ...
- 151
1
vote
1
answer
2k
views
Apache how to make a directory only accessible from local and also use autheticate with valid-user
I try to do this with require local and require valid-user but look like the require local override the valid-user. make the local acess don't need to authenticate
AuthName "Authenticate"
AuthType ...
- 133
1
vote
1
answer
2k
views
how to make squid revere proxy with authentication send remote_user header
OS CentOS 6.4 - squid 3.1
I currently have squid running as a reverse proxy, performing NTML authentication succesfully. This is working as expected. If I enter valid AD username and password, it ...
- 41
3
votes
1
answer
18k
views
How to disable nginx basic_auth for one location but enable it for the rest of the site
I'm trying to get basic_auth disabled for a specific directory (/api/), but still have basic auth for the rest of the site I'm working with. The following is my nginx.conf:
server {
# base ...
- 31
1
vote
1
answer
2k
views
Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb
I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module?
The relevant sections of my ...
- 207
1
vote
1
answer
869
views
Nginx ignores HTTP Authentication for WordPress login directory
I am running WordPress in a subfolder of my domain for testing and development purposes on a VPS LEMP-stack. In order to password-protect the wp-login.php with an etxra layer, I used HTTP ...
- 111
0
votes
1
answer
640
views
Apache mod_proxy with SSL not redirecting
I have a custom server running behind an apache reverse proxy. Since the custom server can only handle HTTP traffic, i am trying to use apache for wrapping proper SSL around it, and for some kind of ...
- 373
0
votes
1
answer
196
views
Restricting access from the internet to a website in beta conflicting with the website's own authentication
I have a java website that runs on Apache Tomcat.
As the website is in Beta, I don't want it to be publicly accessible to anyone on the internet and I want a restricted group of beta testers to ...
- 63
1
vote
1
answer
6k
views
nginx http auth only working on folders, not on files
I am new to nginx and I really enjoy how fast it is in combination with php-fpm.
I want to protect a folder with
location / {
try_files $uri $uri/ $uri.php /;
auth_basic "...
- 1,619
2
votes
0
answers
563
views
How do I enable digest auth for Jetty fronting Elastic Search
We've gotten Jetty running the HTTP front end of Elastic Search with BASIC authentication. We would like to use DIGEST authentication instead, but the Jetty documentation is hard to reconcile with the ...
- 441
2
votes
0
answers
374
views
Apache SSHA password support
Is there any way for Apache to support SSHA passwords?
I have a couple of dozens of user passwords in an OpenLDAP server which are encrypted with SSHA (i.e. salted SHA1). No more users are to be ...
- 440
2
votes
1
answer
16k
views
Nginx auth only for given location
I'm using Nginx as a reverse proxy for a python WSGI web-app.
It looks something like that:
location / {
#auth_basic "Administrator Login";
#auth_basic_user_file /var/www/static/....
- 265
0
votes
1
answer
2k
views
Cannot setting up path based authentication in subversion
I've followed the subversion book countless times to try and set proper path authorization on our subversion server, but I haven't been able to make this work. Here is my access rules file :
[...
- 548
1
vote
1
answer
1k
views
nginx, apache http authentication
I have an nginx reverse proxy server which feeds into a varnish cache with an apache backend.
The php is running as a fastcgi process started from apache.
I was attempting to get some php software ...
- 383
2
votes
1
answer
126
views
static big files and a way to serve them securely (central authentication CDN)
I need to serve few static big files(about 4GB each) to several users, using 5 servers that are in different geographical regions.
The idea is that nobody else gets the content as there's ...
- 64
-1
votes
1
answer
138
views
Intercept server port to request a password [closed]
There's a Java application running on my server that creates a page on a certain port on the server. Is there any way I can sit in the middle of that page being served by Java and the user to first ...
- 111
3
votes
1
answer
239
views
How do you http-auth all sites on a server?
I'm setting up a development server and need to apply these basic rules to all virtual hosts on the server in the /var/www/html directory.
AuthType Basic
AuthName "Development Area"
AuthUserFile /var/...
- 187
0
votes
1
answer
53
views
Allow Site and Server acces from single computer?
I have a local site that I use to run a web application for my business. Only one or two computers need to be able to access the site.
I want to allow access to only those computers (not by IP) with ...
- 133
2
votes
1
answer
2k
views
Does IIS support HTTP basic auth and form auth at the same time?
preface: I am a web dev who knows apache servers quite well, but I have little to no knowledge of IIS or .NET
I work with a developer who has been avoiding a request to add a Basic Auth to a staging ...
- 23
1
vote
1
answer
415
views
Apache Authentication Still Accepts the old password in the htpasswd
I run Apache on Ubuntu and use basic HTTP authentication.
I have a htpasswd file and there is a user named scott with the password of tiger.
However I changed the password to tiger1.
Now I can login ...
- 311