# Basic auth not working 100%

**URL:** <https://www.ruby-forum.com/t/basic-auth-not-working-100/186479>\
**Category:** NGINX\
**Created:** [April 7, 2010, 5:34pm UTC](https://www.ruby-forum.com/t/basic-auth-not-working-100/186479 "2010-04-07T17:34:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AMP\_Admin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3ab097/32.png) [@AMP\_Admin](https://www.ruby-forum.com/u/AMP_Admin)\
**Post date:** [April 7, 2010, 5:34pm UTC](https://www.ruby-forum.com/t/basic-auth-not-working-100/186479/1 "2010-04-07T17:34:21Z")

</div>

On one of my boxes I noticed that if the password is only half the  
string it  
will authenticate.

Should be:

Username: tester

Pass: ThisPassword1234#&^

But the following authenticates:

Username: tester

Pass: ThisPassword

Can anyone confirm this behavior?

---

<div class="post-metadata">

**Author:** ![AMP\_Admin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3ab097/32.png) [@AMP\_Admin](https://www.ruby-forum.com/u/AMP_Admin)\
**Post date:** [April 7, 2010, 6:08pm UTC](https://www.ruby-forum.com/t/basic-auth-not-working-100/186479/2 "2010-04-07T18:08:19Z")

</div>

On Wed, Apr 7, 2010 at 7:33 PM, AMP Admin [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> On one of my boxes I noticed that if the password is only half the string it  
> will authenticate.  
> Should be:  
> Username: tester  
> Pass: ThisPassword1234#&^  
> But the following authenticates:  
> Username: tester  
> Pass: ThisPassword  
> Can anyone confirm this behavior?

ThisPass will also authenticate - crypt() uses only first 8 symbols of  
the password.

–  
Boris D..

---

<div class="post-metadata">

**Author:** ![AMP\_Admin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3ab097/32.png) [@AMP\_Admin](https://www.ruby-forum.com/u/AMP_Admin)\
**Post date:** [April 8, 2010, 4:52pm UTC](https://www.ruby-forum.com/t/basic-auth-not-working-100/186479/3 "2010-04-08T16:52:25Z")

</div>

Yeps that’s a shortcoming of crypt(). One way to go around it is to use  
a 8  
char password, but a pretty random string (the “password”) as the  
username  
😉

Ray.

---

<div class="post-metadata">

**Author:** ![AMP\_Admin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3ab097/32.png) [@AMP\_Admin](https://www.ruby-forum.com/u/AMP_Admin)\
**Post date:** [April 11, 2010, 11:52am UTC](https://www.ruby-forum.com/t/basic-auth-not-working-100/186479/4 "2010-04-11T11:52:19Z")

</div>

On Sat, Apr 10, 2010 at 10:33 PM, AMP Admin [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> is there a way to make it longer?

bcrypt ($2a$…) passwords can be used - on FreeBSD, at least.

–  
O\< ascii ribbon campaign - stop html mail - [www.asciiribbon.org](http://www.asciiribbon.org)