0

I set basic auth in my nginx

location / {
            auth_basic "Restricted Area";
            auth_basic_user_file /etc/nginx/.htpasswd;
}

So after i saved and restart nginx. The browser uses the Authorization header to pass the basic auth

But my front application also uses this header (Authorization) to create http requests to the server, causing a conflict.

Is there anyway to let nginx use another header for basic auth?

for example: Authorization_basic

Мохамед Русланович
  • 3
  • 2
  • 2
    Note that basic authentication comes with many short comings and this is another one. The Authorization header is mandated by RFC standards and AFAIK web browser can't be instructed to use a different header. – HBruijn Aug 14 '23 at 13:39
  • @HBruijn thank you – Мохамед Русланович Aug 14 '23 at 16:02
  • 1
    The best you can is to use another authentication scheme (e.g. token-based) in the application, and/or use TLS client certificate authentication on the server level, where the latter has the benefit of substantially better security and can be used to implement a true 2-factor scheme (when physical security token is used for client private key storage). – Nikita Kipriyanov Aug 15 '23 at 06:11

2 Answers2

0

A really bad solution would be to use Proxy Authenticate/Proxy-Authorization from one of the servers and WWW-Authenticate/Authorization from the other. While nginx would be the logical candidate as the proxy authenticator, IIRC it does not implement proxy authentication. o either you'd have to swap around the designations or offload the validation of Proxy-Authorization.

Wouldn't it just be simpler to implement WWW-authenticate in the nginx proxy and replace the Authorization header (proxy_set_header) with a static value the app will recognize?

symcbean
  • 21,009
  • 1
  • 31
  • 52
-1

A quick overview of Basic Auth.

Narrative:

Authentication

  1. A POST request is made to example.api.com/v1/auth using:

Authorization: Basic YWRtaW46bGV0bWVpbg==

  1. The successful POST response is returned with:

Authorization: Bearer f0222b68-a72d-4eb2-ac13-f6482cf484af

Authorization

  1. A POST request is made to example.api.com/v1/users using:

Authorization: Bearer f0222b68-a72d-4eb2-ac13-f6482cf484af

  1. The successful POST response is return with:

The resource.

suchislife
  • 356
  • 4
  • 11