Questions tagged [http-basic-authentication]
The http-basic-authentication tag has no usage guidance.
255
questions
2
votes
0
answers
29
views
401 Error When Making Basic Authenticated API Calls to X2CRM
We are encountering a 401 error when making basic authenticated API calls to the X2CRM endpoints (index.php/api2/Contacts).
Unauthenticated API calls to other X2CRM VoIP endpoints are successful ...
- 21
0
votes
0
answers
66
views
Combination of HTTP authentication and Shibboleth authentication on the same Apache 2.4 website
I'd like to have 2 types of authentication on my web app (PHP 7.4 on Apache 2.4):
for the URLs /api/ and its children /api/xxxx (not actual directory, just url) I'd like to have HTTP authentication
...
- 1
0
votes
1
answer
93
views
Apache 2.4 REMOTE_USER lowercase
I'm dealing with a legacy system that uses Apache with mod_auth_basic and mod_authnz_ldap for authentication and authorization in given directories and those directories with an .htaccess file. The ...
0
votes
0
answers
131
views
Basic Authentication in .htaccess with RequireAll in httpd.conf
Running Apache 2.4.53 - I have a setup where in httpd.conf I have:
<Location />
<RequireAll>
Require all granted
Require not env something
Require not ip 1.2.3.4
</...
- 99
0
votes
1
answer
93
views
Make nginx look for credentials in "Proxy-Authorization" header, so it works with apt
I have an nginx in front of an apt-cacher-ng. The nginx's job is to terminate HTTPS and take care of authentication.
The issue is, that nginx will look in the Authorization header for credentials, but ...
- 140
1
vote
1
answer
268
views
New user fails authentication with Gerrit setup using proxy HTTP while other users work
We have an issue with authenticating a new user on our Gerrit setup.
We are running Gerrit 2.16 using proxy HTTP behind a dedicated nginx server. The nginx server listens on port 8080, does basic ...
- 111
2
votes
1
answer
241
views
Apache2 OpenLDAP authorization fails using ldap-user
I have an Apache2 server running in a Docker container (httpd:2.4.54-bullseye), and an LDAP server (OpenLDAP slapd 2.4.57+dfsg-3 on Debian 11.1)
I'm trying to use mod_authnz_ldap Apache module to ...
- 123
0
votes
0
answers
52
views
get REMOTE_USER without Require valid-user?
I want my program to get the REMOTE_USER variable if this user has authenticated to this web site (server), but not to demand authentication from people who haven't. That is, it's a web page which ...
- 1
0
votes
1
answer
609
views
HAproxy's http-check to a site requesting basic auth
HAproxy should use httpchk against a page that requires authentication via basic auth.
backend backendname
option httpchk
http-check send meth GET uri /check/path/ ver HTTP/1.1 hdr ...
1
vote
0
answers
484
views
Nginx basic_auth for entire site (reverse proxy) except for a "hidden" URL which should access all content without basic_auth
TL'DR
set a gibberish URL in nginx site definition that would bypass basic-auth to reverse-proxy
More details:
I have a setup with Grafana running on a VPS and an nginx reverse proxy directing towards ...
- 185
0
votes
1
answer
158
views
Why is my Windows 11 host sending connection reset packets to AWX using certificate authentication?
Here is what I have done so far.
Installed AWX 2.9 using docker on CentOS.
Successfully managing Windows nodes (8,10) through AWX and WinRM using certificate authentication. (No problem here)
...
0
votes
1
answer
1k
views
Apache 2.4, reverse proxy, forward credentials (basic auth)
I want to pass the basic authentication credentials to the reverse proxy server.
Example of how it works now:
User accesses the website, Apache is configured to ask for basic auth, user enters ...
- 1
0
votes
2
answers
1k
views
Basic auth and data from curl to HAProxy backend not working on TLS Termination - but works on TLS passthrough
listen pki
bind *:8884 ssl no-sslv3 crt /HAPROXY.pem.ecdsa verify required ca-file /CA_CHAIN.pem
mode http
http-request add-header Content-Type "application/pkcs10"
http-...
- 101
0
votes
0
answers
741
views
Nginx Reverse proxy with basic auth and ssl, to many request errr
I have a config with a reverse proxy, basic authentication and SSL certificate from Certbot. When I try to connect to the domain, I get the error to many requests and see in the network tab that the ...
- 1
0
votes
1
answer
815
views
Nginx Disable Basic Auth - Laravel Forge
On a Laravel Forge Nginx Server I've enabled basic auth security at a root level for my site, this is working fine.
However I'm now trying to exclude a webhooks path from basic auth to allow the site ...
- 101
1
vote
2
answers
93
views
HTTPD server does LDAP authentication. How does the mechanism work?
I have a HTTPD apache server which does LDAP authentication. When the user hits the URL http://localhost/, a browser prompt pops up asking for username and password.
How are the username and password ...
- 73
4
votes
2
answers
4k
views
.htaccess - Exclude folder from basic auth protection
I have a website where no one is allowed to enter without entering the basic auth credentials.
However, I need the media folder to be accessible by everyone, because we are using a third party ...
- 451
1
vote
1
answer
1k
views
Varnish with Basic auth returns 401
I've tried to configure Varnish on server which has Basic Auth authentication by using these solutions:
https://stackoverflow.com/a/40424168/7202171
https://blog.tenya.me/blog/2011/12/14/varnish-http-...
2
votes
1
answer
83
views
I'm not sure if basic auth on my server is being secured
This may be a really dumb question but I had to make sure that i'm fine with this.
I setup an HTTPS server with basic auth, but the browser informs me that the connection is not secured when i connect ...
- 23
1
vote
1
answer
774
views
Nginx Http Basic Auth Security
So lets say I host something like netdata dash board on port 6000.
Then I nginx reverse proxy it to the subdomain netdata.domain.com
While basic auth is applied at the nginx.conf to allow site wide ...
user760466
0
votes
1
answer
1k
views
How to Exclude Basic Auth from Nginx Subdomain
I have the two lines of basic auth added in the nginx.conf.
So that all subdomain blocks under reverse proxy are password protected. But I do have a few in which I don't want it to have that.
What do ...
user760466
2
votes
1
answer
424
views
Are there common situations that cause a "401 Error" being displayed without a login dialog being displayed first?
Perhaps this is a somewhat broad question, but I am currently relying on shots in the dark ...
We sometimes provide access to some web URLs (running Apache 2.4) protected by basic password protection.
...
- 824
0
votes
1
answer
745
views
nginx: autoindex with basic auth
I have a running website where I have a specific directory where I store random stuff (it sounds very informal and it indeed is).
So, I wanted to have some sort of index there that lists the contents ...
0
votes
0
answers
962
views
Password protecting an upstream server using Nginx
I've been searching for ages and whilst I can find lots of questions about proxying to a password-protected server using Nginx, I can't find any references to how to go about adding basic ...
- 173
1
vote
1
answer
731
views
nginx basic_auth fails when moving outside location, to "root"
This works:
location /someplace/ {
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/.htpasswd;
}
I go to /someplace/ and I get prompted for the user and password and can ...
- 3,172
1
vote
1
answer
374
views
Is it possible to use a auth_basic password protection using linux users and passwords?
I'd like to password protect a website allowing only Linux users and their passwords stored in /etc/passwd and /etc/shaddow to login.
Apache and nginx allow to restrict accessung by using a HTTP ...
- 234
3
votes
1
answer
1k
views
Can I use rate-limiting with HTTP basic authentication in Apache?
So I'm running a few popular web applications on my server. I want these to be reachable from any computer without creating too many vulnerabilities.
I am using Apache 2.4.29 as my HTTP server. My ...
- 33
0
votes
1
answer
488
views
Redirect incoming URL request between basic authentication and openidc in apache
Redirect incoming URL request between basic authentication and openidc. I want to categorize if the request for URL is coming from "wget/curl" then i need it to get authenticated with Basic ...
- 1
1
vote
0
answers
2k
views
curl not sending credentials during negotiation
We have a Jenkins server that uses Kerberos-SSO, with a fallback to Basic if SSO is not configured on the browser or using curl.
When I use curl with the --negotiate argument, however, it doesn't send ...
- 534
0
votes
0
answers
629
views
SSL Connection to MySQL database
I have read some answers here on serverfault that suggests it is not a good idea to open a MySQL port to the firewall, so I am trying to setup accordingly.
Two options remain to connect to MySQL:
SSH ...
- 103
1
vote
0
answers
321
views
Apache2 Location directive and mod_rewrite
I have a website that is protected with basic authentication, except for one file, one folder, and one rewritten URL location.
It looks like this:
<Directory /var/www/mydomain.com>
AuthType ...
- 944
0
votes
0
answers
54
views
Require IP still asking for login
I set following vhost which I want to be accessible without login when called from within the network, but with login when called from outside. However, no matter how I change the Require IP, ...
- 1
0
votes
0
answers
1k
views
Basic Authentication not working on Apache 2.4.6 <Location ...>
Just moved a site to new server, replaced the Allow.... directives with Require...
Centos7, Apache 2.4.6
I have one location that I was using basic authentication and working fine, here is the ...
- 21
1
vote
1
answer
2k
views
How to disable basic authentication when using kerberos on nginx?
My task is to configure Kerberos authentication on nginx. The backend is django. The idea is that when a request is made to api, nginx should perform kerberos authentication. But in case the user is ...
- 11
1
vote
0
answers
61
views
Apache individual DocumentRoot per REMOTE_USER
How can I give authenticated users an individual view of the DocumentRoot?
I would like to lock users in their own directory. When alice visits http://example.net/ she only sees /srv/www/alice/ and ...
- 111
1
vote
0
answers
272
views
gitweb: Use Apache HTTP basic authentication for repository authentication
I use gitweb to serve remote Git repositories on a server running Apache2. Everything is setup with automatic redirection from HTTP to HTTPS and Basic password authentication (though this might change ...
- 111
1
vote
0
answers
198
views
basic auth for all pages except one
I have a wordpress page and want to add basic auth to the page, except for the wordpress rest api (url: localhost/wp-json/xyz)!
The main problem seems to be the redirect that happens in the standard ....
- 11
0
votes
1
answer
277
views
mod security blocking basic authentication
I have a vps with centos 7, apache with mod_security and mod_evasive. I have a form in php with basic authentication. When I try to authenticate through the application (before activating mod security ...
- 1
3
votes
2
answers
3k
views
Disabling (Apache) Basic Authentication for OPTIONS requests
I have Apache basic authentication enabled on a test server and it works great:
AuthType Basic
AuthName "testing"
AuthUserFile /home/www/.htpasswd
Require user MyUser
deny from all
But it is also ...
- 133
2
votes
1
answer
765
views
How do I get Nginx to work with subdirectories? [Nginx, Let's Encrypt, basic auth]
What I want:
I want to install Mautic in a subfolder of my web root. I have a domain https://example.com and I want Mautic to be accessible from https://example.com/mautic.
What I have:
I have a ...
0
votes
1
answer
2k
views
Require basic auth for specific IPs in nginx
I have a whitelist of IPs for nginx, but in addition to this I want to require basic authentication for specific IP.
For example, allow access for these IPs:
198.51.100.1
198.51.100.2
require basic ...
- 276
1
vote
1
answer
1k
views
Basic Auth in htaccess... only if in a specific subpath
We deploy the same code with the same .htaccess to Integration, Stage and Production.
I want to require a basic auth on all but the Production server.
They differ in the path, e.g. /data/stage/www/...
- 142
1
vote
1
answer
604
views
Adding Basic Authentication to Nginx that contains existing Rewrite rules
I have images successfully served through a Nginx rewrite rule:
# Rewrite part ==============
location ~* "^/([a-z]{5})/([0-9]{5}).png$" {
rewrite .* "/$1/image_handler.php?x=$2" last;
}
Now I ...
- 121
1
vote
0
answers
1k
views
nginx Basic Authentication configuration on windows can't find user in auth_basic_user_file
I'm trying to set up basic authentication on an nginx 1.14.2 server on a Windows 7 machine.
Here's my test configuration:
worker_processes 1;
events {
worker_connections 1024;
}
http {
...
- 111
1
vote
1
answer
453
views
Nginx. White-list top filter and no auth white-list and basic auth simultaneously
Can't find a way to build the next scheme.
A whitelist of IPs ever allowed. Ban for most of the net.
A sublist of whitelisted IPs allowed to bypass auth. A part of a local net, for example.
Basic ...
- 13
1
vote
1
answer
7k
views
How can I access an environment variable set by a rewrite rule in an expression?
I am working on a Symfony 3.4 application which has public and private parts. However, I am currently setting up a staging system for this application which should only be accessed by authorized users,...
- 181
0
votes
2
answers
1k
views
restrict access to subdirectory in apache, leaving parent open
I am setting a webdav on apache2.4 and I need for my top directory /webdav to be freely open and for a sub directory like /webdav/projects/secretproject to be protected with a password.
My curremt ...
- 316
0
votes
0
answers
298
views
How to secure an insecure device on an untrusted network, via a web proxy?
Here's my situation: I've got a network-based device with a web-page interface, and the developers of this device, in their wisdom, did not include any kind of access-control or encryption for the ...
- 1,323
0
votes
1
answer
119
views
Apache queries mariadb database -> how to log queries?
I got a apache2 vhost-configuration with BasicAuth. With the AuthDBDUserPWQery directive I'm checking a mariadb in the background, if the user-pw-combination exists.
For troubleshooting I want to see ...
- 1
-1
votes
3
answers
2k
views
Why apache need authorization for url with username and password?
I build basic authorization in apache.Only one line in /var/www/html/remote.html.
<p>it is a test </p>
Now to verify the username and password with curl.
curl -u xxxx:xxxx -v http://...
- 105