I have a reverse proxy that protects backend with basic auth
client -> basic auth reverse proxy -> token auth cakephp backend
1 2 3 4 | curl -v \ -H 'Authorization: Basic base64_encoded_user_pass_here' \ -H 'Authorization: Token cakephptokenhere' \ |
The problem with the above is that the Authorization header succeeds at the reverse proxy and passes both headers through and then CakePHP gets confused by the headers and doesn't auth
The trick is to remove the Authorization Request Header at the proxy and then switch to token query string for the CakePHP auth
1 2 3 4 5 6 7 8 9 10 11 12 13 | # test envProxyPass /subdir http://docker:9999/subdirProxyPassReverse /subdir http://docker:9999/subdir<Location "/subdir"> RewriteEngine On AuthType Basic AuthName "Restricted Area" AuthUserFile "/etc/httpd/myhtpasswd" Require valid-user ProxyPreserveHost On RequestHeader unset Authorization</Location> |
1 2 3 | curl -v \ -H 'Authorization: Basic base64_encoded_user_pass_here' \ |
Yes this is insecure because it exposes an auth token in the query string but all good as it works.
0 Comments