Nginx auth_basic "Restricted" asks for a login for each request

Question

I installed a simple nginx server, configured a location block to point to the appropriate directories that I want to serve, and set up basic authentication using the auth_basic module.

However, my server asks for a username: password credentials for each request for a separate page in the location block even after submitting them several times to different pages under the location block, including the root directory.

How to configure it to store authenticity? Is this a nginx problem or a problem with the browser / request header?

Here is the nginx configuration:

server { listen 80; server_name 0.0.0.0; location /path/to/dir { alias /var/www/dir/; index index.html index.htm; auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd; try_files $uri $uri/ =404; } } 

Running nginx 1.4.6 on Ubuntu.

Answer 1

HTTP authentication information is stored in the browser cache and should only be requested again if authentication fails or from another area (in auth_basic "Restricted"; it is limited).

Your configuration is fine, given that your password is correct and the Nginx user has access to read the password file (the case when it always fails, but sends an error message to the log file indicating this error). This is the most likely reason, mainly if you have only one authentication location.

Another possible reason is that there are several auth_basic directives, and they use different realms or passwords. This is the same for the WWW-Authenticate headers created by the application (say, if your backend application requests HTTP authentication in addition to Nginx). When a failure occurs in different areas or a password, your browser will ask for it again. There is no browser that I know about authentication on every URL, it is always a combination of realm + hostname.

If you need different spheres or passwords in different places, make sure that they do not overlap for one page (for example, if you use a different password for your assets: images, styles or javascript). Or use different hosts - a password will be requested once for each host / area combination.

Update

It is unusual to use 0.0.0.0 since server_name is listen 80; already forces your server to listen on all interfaces / IP addresses.

Use server_name _; if you want to use any host request.

Answer 2

In my case, the problem was that one of the API calls made by JavaScript when the page loaded returned 401. It looked like resetting the browser authorization state for the page.