# HTTP Basic Auth question **URL:** \ **Category:** NGINX\ **Created:** [May 1, 2013, 4:26pm UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645 "2013-05-01T16:26:43Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Russ\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@Russ\_L](https://www.ruby-forum.com/u/Russ_L)\ **Post date:** [May 1, 2013, 4:26pm UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645/1 "2013-05-01T16:26:43Z")
Hello, I am running nginx as a reverse proxy to a python application. I am wondering how I would be able to pass ONLY the user account and not the password. Can this be done? Thanks! ---
**Author:** ![Russ\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@Russ\_L](https://www.ruby-forum.com/u/Russ_L)\ **Post date:** [May 1, 2013, 7:19pm UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645/2 "2013-05-01T19:19:06Z")
To pass the nginx user to a fastcgi backend (PHP), I have to explicitly specify it using the following directive: fastcgi\_param MY\_USER $remote\_user; ## I suppose you can do the same with proxy\_pass? I dunno how to remove an automatically forwarded parameter though… Maybe overwriting it with an empty string? _B. R._ ---
**Author:** ![Russ\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@Russ\_L](https://www.ruby-forum.com/u/Russ_L)\ **Post date:** [May 1, 2013, 11:46pm UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645/3 "2013-05-01T23:46:40Z")
On Wed, May 01, 2013 at 01:17:41PM -0400, B.R. wrote: Hi there, > To pass the nginx user to a fastcgi backend (PHP), I have to explicitly > specify it using the following directive: > fastcgi\_param MY\_USER $remote\_user; > > I suppose you can do the same with proxy\_pass? That’s how I’d do it – probably proxy\_set\_header if the python application is accessed using proxy\_pass. > I dunno how to remove an automatically forwarded parameter though… Maybe > overwriting it with an empty string? The password is in the http header Authorization, so using proxy\_hide\_header to avoid sending that should be enough. > On Wed, May 1, 2013 at 10:26 AM, Russ L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > I am running nginx as a reverse proxy to a python application. I am > > wondering how I would be able to pass ONLY the user account and not the > > password. Can this be done? As above: how are the user and pass currently sent? It will be by “fastcgi\_pass” or “proxy\_pass” or something similar. Use the matching “\_hide\_header” directive on the correct header to avoid sending it. How do you want the user to be sent? Use the variable $remote\_user and the matching “\_set\_header” or “\_param” directive to send the provided username. ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Russ\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@Russ\_L](https://www.ruby-forum.com/u/Russ_L)\ **Post date:** [May 9, 2013, 9:56pm UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645/4 "2013-05-09T21:56:05Z")
Hello, Sorry for the long delay. I have tried the following configuration which does not seem to work at all. proxy\_hide\_header Authorization; proxy\_set\_header Authorization “$remote\_user”;| I can still sniff the traffic on lo and get the base64 user:pass. The interesting thing is I do not see the Authorization header being sent to the django app whatsoever. Is there a way I can totally remove the header even at the loop back level so it is not able to get intercepted? Thanks, Russ ----- Original Message ----- From: Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Cc: Sent: Wednesday, May 1, 2013 4:45 PM Subject: Re: HTTP Basic Auth question On Wed, May 01, 2013 at 01:17:41PM -0400, B.R. wrote: Hi there, > To pass the nginx user to a fastcgi backend (PHP), I have to explicitly > specify it using the following directive: > fastcgi\_param MY\_USER $remote\_user; > > I suppose you can do the same with proxy\_pass? That’s how I’d do it – probably proxy\_set\_header if the python application is accessed using proxy\_pass. > I dunno how to remove an automatically forwarded parameter though… Maybe > overwriting it with an empty string? The password is in the http header Authorization, so using proxy\_hide\_header to avoid sending that should be enough. > On Wed, May 1, 2013 at 10:26 AM, Russ L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > I am running nginx as a reverse proxy to a python application. I am > > wondering how I would be able to pass ONLY the user account and not the > > password. Can this be done? As above: how are the user and pass currently sent? It will be by “fastcgi\_pass” or “proxy\_pass” or something similar. Use the matching “\_hide\_header” directive on the correct header to avoid sending it. How do you want the user to be sent? Use the variable $remote\_user and the matching “\_set\_header” or “\_param” directive to send the provided username. ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) * * * nginx mailing list [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > **[mailman.nginx.org archive](http://mailman.nginx.org/pipermail/)** ---
**Author:** ![Russ\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@Russ\_L](https://www.ruby-forum.com/u/Russ_L)\ **Post date:** [May 10, 2013, 12:25am UTC](https://www.ruby-forum.com/t/http-basic-auth-question/228645/5 "2013-05-10T00:25:38Z")
On Thu, May 09, 2013 at 12:55:22PM -0700, Russ L. wrote: Hi there, > I have tried the following configuration which does not seem to work at all. > > proxy\_hide\_header Authorization; > > proxy\_set\_header Authorization “$remote\_user”;| What did you do; what did you see; what did you expect to see? > I can still sniff the traffic on lo and get the base64 user:pass. The > interesting thing is I do not see the Authorization header being sent to the > django app whatsoever. Is there a way I can totally remove the header even at the > loop back level so it is not able to get intercepted? I don’t understand what it is that you are trying to do, that you have not yet done. You seem to say that you do see the Authorization header and that you don’t see the Authorization header, so I presume I’m misreading something. Can you provide a simple nginx configuration that I can use to replicate whatever the problem is? ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)