Remove basic authentication header with apache mod proxy

apache mod-proxy basic-authentication
Jan picture Jan · Dec 13, 2010 · Viewed 29.4k times · Source

I have a HTTP Basic secured website. I hide a Tomcat application server with mod_proxy. Can I remove the HTTP Basic header? The Tomcat application reads the header and returns 401 not authorized. Basic auth isn't needed because the application uses cookie sessions. So I think just removing the headers would be fine.

Answer

Justin picture Justin · Apr 14, 2011

Make sure mod_headers is enabled. An example config:

<VirtualHost *:80>
        ServerName something.example.com
        ServerAdmin [email protected]

        ProxyRequests Off
        ProxyPreserveHost Off
        AllowEncodedSlashes On
        KeepAlive Off

        <Proxy *>
            Order deny,allow
            Allow from all
        </Proxy>

        <Location />
                AuthType Basic
                AuthName "Authorized Users Only"
                AuthUserFile /etc/apache2/passwd
                Require valid-user
        </Location>

        RequestHeader unset Authorization
        ProxyPass / http://localhost:5984/ example
        ProxyPassReverse / http://localhost:5984/

        ErrorLog /var/log/apache2/something.example.com-error_log
        CustomLog /var/log/apache2/something.example.com-access_log common
</VirtualHost>

Related questions

Apache2 Reverse Proxy to an end-point that requires BasicAuth but want to hide this from user

Basically my scenario is that I have an internal website that requires a SINGLE hard-coded username and password to access (and this can't be turned off, only changed). I am exposing this website through a reverse proxy for various reasons (…

Read More
apache to tomcat: mod_jk vs mod_proxy

What are the advantages and disadvantages of using mod_jk and mod_proxy for fronting a tomcat instance with apache? I've been using mod_jk in production for years but I've heard that it's "the old way" of fronting tomcat. …

Read More
Setting timeout for all the ProxyPass mappings in Apache Server mod_proxy directive

What I have and works: I'm using Apache HTTPD 2.2 for proxy requests. I have multiple ProxyPass mappings: ProxyRequests On <Proxy *> AddDefaultCharset off Order deny,allow Allow from all </Proxy> ProxyPreserveHost Off ProxyPass /a http://some_ip/ …

Read More