Is there any way to have a reverse proxy using http basic Authentication in front of a REST API which also uses http basic Authentication with different username and passwords?
The reverse proxy is Apache, if it matters.
The most obvious solution seems to be to get the application and the proxy to use different headers for the authentication.
1) For example, I could send a request to the proxy like:
GET /foo/1 HTTP/1.1
Authorization: proxyuserpasshere
X-Passthru-Authorization: restuserpasshere
And then the proxy would consume the "Authorization" header and (if it were valid) pass on a request to the underlying web-app like:
GET /foo/1 HTTP/1.1
Authorization: restuserpasshere
(where the value 'restuserpasshere' was taken from the 'X-Passthru-Authorization' header)
Is there a way to configure Apache to make that work?
2) Conversely, I could use the standard "Authorization" header for the proxy, and use a custom header for my application's authentication. So the request would look like:
GET /foo/1 HTTP/1.1
Authorization: proxyuserpasshere
X-Myapp-Authorization: restuserpasshere
The drawback to this is that my app is now hardcoded to use the "X-Myapp-Authorization" header instead of the standard Authorization header.
Is there a better way around this?
