Bypass http authentication by using a reverse proxy

Question

We are running a legacy web application which uses HTTP Authentication. I want to make this application available to some users but I do not want to expose the username/password and I don't want to expose the server the application is running on.

To solve this problem I intend to use mod_proxy. I made the following configuration:

<VirtualHost *:443>
    # SSL stuff goes in here
    ServerName "proxy.local"
    ProxyRequests Off
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    ProxyPass / http://admin:[email protected]:80/
    ProxyPassReverse / http://admin:[email protected]:80/
</VirtualHost>

This works, except for the part where users are still asked to type admin/password themselves. Can I make Apache send the username/password provided in ProxyPassReserve and not ask the user for it? I could not find the answer in the Apache mod_proxy documentation.

Boris · Accepted Answer · 2012-03-17 18:37:20Z

3

You will have to enable mod_headers and set http Authorization header before passing request from the mod_proxy.

Just base-64 encode the admin:password string and add RequestHeader directive to your configuration:

RequestHeader set Authorization: "Basic YWRtaW46cGFzc3dvcmQ="


<VirtualHost *:443>
    # SSL stuff goes in here
    ServerName "proxy.local"
    ProxyRequests Off
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    ProxyPass / http://legacy.local:80/
    ProxyPassReverse / http://legacy.local:80/
    RequestHeader set Authorization: "Basic YWRtaW46cGFzc3dvcmQ="
</VirtualHost>

answered Mar 17, 2012 at 18:37

Boris

2,27320 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Bypass http authentication by using a reverse proxy

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related