I have a HTTP Basic secured website. I hide a Tomcat application server with mod_proxy. Can I remove the HTTP Basic header? The Tomcat application reads the header and returns 401 not authorized. Basic auth isn't needed because the application uses cookie sessions. So I think just removing the headers would be fine.
Make sure mod_headers is enabled. An example config:
<VirtualHost *:80>
ServerName something.example.com
ServerAdmin admin#example.com
ProxyRequests Off
ProxyPreserveHost Off
AllowEncodedSlashes On
KeepAlive Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
AuthType Basic
AuthName "Authorized Users Only"
AuthUserFile /etc/apache2/passwd
Require valid-user
</Location>
RequestHeader unset Authorization
ProxyPass / http://localhost:5984/ example
ProxyPassReverse / http://localhost:5984/
ErrorLog /var/log/apache2/something.example.com-error_log
CustomLog /var/log/apache2/something.example.com-access_log common
</VirtualHost>
I just had the same problem with Apache in front of another Java server trying to do basic auth, adding the following to my Apache config seemed to fix it:
RequestHeader unset Authorization
Related
I want to configure an apache Auth proxy for access to QuestDB that does not have Authentication system. I try it to VM in a first time.
I made a very simple configuration:
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www/html
<Proxy *>
Order deny,allow
Allow from all
AuthType Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Proxy>
ProxyPass / http://127.0.0.1:9000/
ProxyPassReverse / http://127.0.0.1:9000/
ProxyRequests Off
</VirtualHost>
I configured my QuestDB with a bind adress http://127.0.0.1:9000.
When I go to http://myipadress and give my Apache authentified user, I have :
Bad request
refresh
Content without CSS
refresh
Bad request
refresh
QuestDB opened
refresh
and looping like this forever.
Any idea ?
When I just set the ProxyPass / ProxyPassReverses lines, I got the same phenomenom.
I have enabled my Apache server mods : proxy_http, proxy, rewrite and cache and the default ones that are enabled.
The below config is working for me. I think the difference is I am not using a DocumentRoot.
<VirtualHost *:80>
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
AuthType Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Proxy>
ProxyRequests Off
ServerName 127.0.0.1:80
ServerAlias localhost
ProxyPass / http://localhost:9000/
ProxyPassReverse / http://localhost:9000/
</VirtualHost>
I have apache2.4 set up and when visiting any apache served web sites basic authentication works great.
Now I have one more webserver running from an other service at port 8000 and I wanted to setup apache as a reverse proxy hoping that it can also impose and handle basic authentication there as well...but instead for asking for user and password it just serves the website unprotected.
my setup is:
<VirtualHost *:8000>
ProxyPreserveHost On
ProxyPass / http://192.168.0.101:8000/
ProxyPassReverse / http://192.168.0.101:8000/
<Location />
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>
what am i doing wrong?
Update:
solution found by marked answer:
<VirtualHost *:8000>
ProxyPreserveHost On
<Location />
ProxyPass http://192.168.0.101:8000/
ProxyPassReverse http://192.168.0.101:8000/
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>
Also make sure that apache is configured to listen to that port and also if the proxied server is local it is not running at the same port as listened one
The problem is that Apache doesn't 'link' Proxypass / http://example.com and <Location /> - even though they both try to work with /. This means that Proxypass is handling requests for '/' first, and the Location section is never being used.
You need to move the Proxy config inside the Location, dropping the path, e.g.:
<VirtualHost *:8000>
ProxyPreserveHost On
<Location />
ProxyPass http://192.168.0.101:8000/
ProxyPassReverse http://192.168.0.101:8000/
AuthType Basic
AuthName "Authorization"
AuthUserFile /etc/htpasswd/.htpasswd
require valid-user
</Location>
</VirtualHost>
I'm running a Spotify server on my Raspberry Pi at my school's robotics shop. It's on the school wifi network and it's accessed through a webpage http://localhost:6680. I wanted to add basic HTTP authentication (username/password) because people were being malicious, so I'm using an Apache VirtualHost as a proxy with basic authentication.
In addition, the webserver requires WebSockets to function through the same port. I successfully set up a VirtualHost file and it's working fine... except it's not working on Safari or iOS. After looking in the console, all WebSocket requests in Safari are returning a 401 error:
WebSocket connection to 'ws://XX.XXX.XX.XXX/iris/ws/' failed: Unexpected response code: 401
After looking into this more, apparently it's a known bug with Safari. Here's the VirtualHost file:
<VirtualHost *:80>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Proxy *>
Allow from all
</Proxy>
ProxyRequests On
ProxyPass /mopidy/ws/ ws://localhost:6680/mopidy/ws/
ProxyPassReverse /mopidy/ws/ ws://localhost:6680/mopidy/ws/
ProxyPass /iris/ws/ ws://localhost:6680/iris/ws/
ProxyPassReverse /iris/ws/ ws://localhost:6680/iris/ws/
<Location />
ProxyPass http://localhost:6680/
ProxyPassReverse http://localhost:6680/
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Location>
</VirtualHost>
Is there any way we can simply remove authentication for just the websockets but not for the webpage? Considering how this is structured, that should be the case, but it isn't. Thanks!
I don't know much about WebSockets, but I do know that you should always declare the VirtualHost port you are listening to if you want to separate traffic.
Try to do so by adding two different VirtualHost in the same configuration:
<VirtualHost *:80>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Directory "/">
AllowOverride All
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
</VirtualHost>
From now on I can't help further:
<VirtualHost *:6680>
somethingsomethingsomething
</VirtualHost>
Update
Traffic different from :80 is blocked in your school, I guess.
I can suggest a more radical approach which is banning all traffic from Safari (both desktop and mobile).
You can modify the config by adding a redirect to a courtesy page like "your browser is not supported".
<Location *>
SetEnvIfNoCase User-Agent .*Safari* bad_browser
Deny from env=bad_browser
</Location>
Make sure you are proxying over your websockets if needed. They might look something like this:
ProxyPass /socket.io http://localhost:6680/socket.io
ProxyPassReverse /socket.io http://localhost:6680/socket.io
Try do next, like described here:
#In your case it will be like this:
<LocationMatch /(iris|mopidy)/ws>
Allow from all
</LocationMatch>
Update: Please be aware this rule to wide as you see.
How do you combine basic auth with a reverse proxy in Apache?
I have an Apache site currently configured to use basic auth with an htpasswd file using this config:
<VirtualHost *:80>
# Requires: a2enmod proxy_http
ProxyPass / http://127.0.0.1:8010/
<Location />
AuthType Basic
AuthName "Sensitive"
AuthUserFile /usr/local/myproject/htpasswd
Require valid-user
</Location>
</VirtualHost>
Apache is acting as a wrapper around a Buildbot server being served on port :8010. However, this app has been upgraded so it now requires the use of websockets. The suggested Apache configuration is:
<VirtualHost *:80>
<Location /ws>
ProxyPass ws://127.0.0.1:8010/ws
ProxyPassReverse ws://127.0.0.1:8010/ws
</Location>
ProxyPass /ws !
ProxyPass / http://127.0.0.1:8010/
ProxyPassReverse / http://127.0.0.1:8010/
</VirtualHost>
However, this doesn't use any authentication. I tried re-adding my <Location /> section from the previous config, so I now have:
<VirtualHost *:80>
<Location />
AuthType Basic
AuthName "Sensitive"
AuthUserFile /usr/local/myproject/htpasswd
Require valid-user
</Location>
<Location /ws>
ProxyPass ws://127.0.0.1:8010/ws
ProxyPassReverse ws://127.0.0.1:8010/ws
</Location>
ProxyPass /ws !
ProxyPass / http://127.0.0.1:8010/
ProxyPassReverse / http://127.0.0.1:8010/
</VirtualHost>
and although Apache now correctly prompts for my username+password, the Buildbot still isn't given authenticated username and still renders for an anonymous user.
How do I fix this config to pass the username (I believe the REMOTE_USER header) through to the web app behind the reverse proxy?
I have a Apache proxy which serve the ssl for the client. The Apache then proxy to a plain http tomcat server.
Listen 7777
<VirtualHost *:7777>
ServerName my.server.com
SSLEngine on
SSLCertificateFile /some.crt
SSLCertificateKeyFile /some.pem
SSLProxyEngine on
# Replace HTTP response headers (http to https)
Header edit Location ^http:(.*)$ https:$1
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyPass / http://my.server.com:8888/
ProxyPassReverse / http://my.server.com:8888/
<Location />
Order allow,deny
Allow from all
</Location>
</VirtualHost>
Everything is working fine but when I access
https://my.server.com:7777/jmx-console
I get a
http status 403 Access to the specified resource () has been forbidden.
If I access the backend directly
http://my.server.com:8888/jmx-console
I get the basic authentication dialog
I want the Apache to show the backend basic authentication dialog from tomcat. What am I missing?
Perhaps you need to use 'proxy-chain-auth':
SetEnv proxy-chain-auth On
AuthType basic
AuthBasicAuthoritative Off