Basic Auth

# Introduction

Basic Auth is an authentication method implemented over the HTTP protocol that requires a user to request a resource from a server with username and password information in the request header. The server receives the information in the request header and validates the information. If the validation passes, the requested resource is returned, otherwise, a 401 error code is returned.

Note: When using Basic Auth, the username and password are transmitted explicitly in the request header and are not recommended for use in production environments.

A corresponding page rule action is provided in OpenResty Edge to implement this feature.

This action has only one parameter: Basic Auth User Group, which specifies the user group to be used.

# Example

Basic Auth users of OpenResty Edge are organized and managed through user groups. Therefore, the user group needs to be added first.

# Add Basic Auth users

Go to: Applications > HTTP/HTTPS > [Specify Application] > HTTP Basic Auth Account > New Basic Auth User Group.

To add a user group.

Enter the user group name as well as the label. Then add the user.

Enter the username and password.

# Add page rules

Add a page rule to enable the Basic Auth.

Just select the user group we created earlier.

# Send a test request

Send a request without authentication information.

$ curl http://test.com/anything -v
...
< HTTP/1.1 401 Unauthorized
...

You can see that a 401 status code is returned, indicating that authentication information is missing.

Next, send a request with the correct authentication information.

$ curl http://test.com/anything -u oredge:xxxxxxxxx -v
...
< HTTP/1.1 404 Not Found
...

No 401 is returned, indicating that Basic Auth authentication has been passed; 404 is returned because the request accessed a non-existent resource (/anything).