Rails HTTP Basic Authentication Failure

Question

I'm trying to use authenticate_with_http_basic in a Rails 2.3.4 app, and the username and password aren't being picked up. I did a little detective work and figured out that it's failing because there's no authorization header in the request. I tried adding the RewriteRule suggested in the docs:

RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]

I haven't had any luck, though, either with Apache/Passenger or Mongrel. I also didn't have any luck trying authenticate_with_http_basic in a Rails 3 app. If I change it to authenticate_or_request_with_http_basic, credentials given at the prompt work, but it ignores any supplied in the url. (Which makes sense, since it's calling authenticate_with_http_basic.) I can't find anything in my code that should be messing with the request, and it seems odd to me that it isn't working locally with Mongrel. Any suggestions?

Austin Lin · Accepted Answer · 2010-12-13 23:10:57Z

3

I would strongly recommend using an authentication gem/plugin like Devise or Authlogic. They both support basic HTTP authentication.

Devise: https://github.com/plataformatec/devise and http://railscasts.com/episodes/209-introducing-devise

Authlogic: https://github.com/binarylogic/authlogic and http://railscasts.com/episodes/160-authlogic

answered Dec 13, 2010 at 23:10

Austin Lin

2,56417 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Nancy Over a year ago

I'm using Authlogic, but the problem is not so much how to authenticate the user but why the data isn't coming through. And even if I can find a different approach, I'm curious about why authenticate_with_http_basic isn't working!

Topher Fangio · Accepted Answer · 2011-05-23 21:08:29Z

0

For any future viewers: if it appears that Rails is receiving something different for the Authorization header than you think you are sending, check to ensure you aren't using .htaccess/.htpasswd files. The browser apparently remembers the credentials and it overrides anything you send!

Just spent like 3 hours trying to figure this out. I sure hope it helps someone else down the line :-)

answered May 23, 2011 at 21:08

Topher Fangio

20.7k15 gold badges64 silver badges94 bronze badges

Collectives™ on Stack Overflow

Rails HTTP Basic Authentication Failure

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related