基本的HTTP身份验证，并从静态内容（即image / js / css）网址中删除前缀文本username：password @

Question

I have site where user need to get http basic authentication prior to access the url lets say www.mybasicauthurl.com . Basic authentication can be passed in either way

1. Browse the url and enter the username, password on the pop-up if not done already.

2. Access the url as: username:password@www.mybasicauthurl.com

Now I use approach #2 supply the basic auth credential via url itself. This works fine and I can able to see the legitimate web page but When I open firebug and see the all loaded static files it shows me something like

http://username:password@www.mybasicauthurl.com/static/jquery/jquery.js
http://username:password@www.mybasicauthurl.com/static/css/styles.css
http://username:password@www.mybasicauthurl.com/static/image/image1.png

Please note the prepend text username:password@ in the url. I don't want that I just want these static files to be loaded normally like

http://www.mybasicauthurl.com/static/css/styles.css

I don't know if this is something done by the browser or apache server. Would be appreciated even if share some useful link that I missed to google.

Answer 1

If you want to avoid HTTP auth on static resources, the best thing to do is to remove it server-side .

That means static resources would ba available without authentication, but if nothing important is present in the static resources, that's good.

Should be something like that:

# Apache < 2.4
<Location /static>
    Satisfy Any
    Allow from all
</Location>

# Apache >= 2.4
<Location /static>
    Require all granted
</Location>

Another point . If the thing you do not like is the presence of username:password in the HTML source, that's effectively quite bad, and depending on the browsers versions it may or may not be supported (tends to be removed). That's a clear text information, could be intercepted or stored on the browser cache. But you are also using http:// and not https:// and this is even worse. The username:password is transmitted in clear text for each request of the browser , everybody can read this information!

When using Basic HTTP Authentification you must use HTTPS. Credentials are transmitted with a simple base64 encoding , it's just an ascii-7-trick encoding (like utf-8 is an encoding). So if you want to protect this username/password information you will also need HTTPS.