Home / server / Questions

Questions[http-basic-authentication](server)

Martin Hope
ripper234
Asked: 2012-03-22 03:16:58 +0800 CST
  • 228

I believe this is not possible, but someone I know insisted that it works. I don't even know what parameters to try, and I haven't found this documented anywhere.

I tried http://myserver.com/~user=username&password=mypassword but it doesn't work.

Can you confirm that it's not in fact possible to pass the user/pass via HTTP parameters (GET or POST)?

http authentication http-basic-authentication
Martin Hope
Benjamin Wohlwend
Asked: 2011-11-14 12:07:38 +0800 CST
  • 40

I have a relatively straight forward config:

upstream appserver-1 {
    server unix:/var/www/example.com/app/tmp/gunicorn.sock fail_timeout=0;
}
server {
    listen  80;
    server_name  example.com;

    location / {
        proxy_pass http://appserver-1;
        proxy_redirect              off;
        proxy_set_header            Host $host;
        proxy_set_header            X-Real-IP $remote_addr;
        proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;

        auth_basic                  "Restricted";
        auth_basic_user_file        /path/to/htpasswd;

    }

    location /api/ {
        auth_basic          off;
    }
}

The goal is to use basic auth on the whole website, except on the /api/ subtree. While it does work with respect to basic auth, other directives like proxy_pass are not in effect on /api/ as well.

Is it possible to just disable basic auth while retaining the other directives without copy&pasting everything?

nginx http-basic-authentication
Martin Hope
Gabriel
Asked: 2011-07-15 08:29:11 +0800 CST
  • 8

I've protected a directory with satisfy and basic_auth, but seems that the validation is not stored in a cookie which after some time it's deleted, seems it's ip or something based. So i login once and eve if i keep the website open for half an hour, it does not re-request the validation.

Is there a way to set a timeout? ie, get access 10 minutes and after that, have to login again if clicking on a file?

timeout nginx http-basic-authentication
Martin Hope
hokkaido
Asked: 2010-04-02 09:05:28 +0800 CST
  • 8

I'm settings up nginx to serve Mercurial repositories. It works when not using basic authentication at all, or when I use basic authentication all over.

What I want to do is to just use basic auth on POST requests, so anyone have pull access, but only authenticated users can push.

I tried the following,

if ($request_method = POST) {
  auth_basic "Restricted";
  auth_basic_user_file /path/to/userfile
}

However it complains about "auth_basic directive is not allowed here".

How can I solve this?

mercurial nginx http-basic-authentication