Removing basic authorization header in Nginx or Apache

Question

The Nginx/Apache serves as a reverse proxy to the backend server. I'd like to write a rule to remove the Authorization header if the value starts with "Basic". That is the Nginx/Apache server won't pass the Basic auth header, but it will pass all other Authorization headers.

Answer 1

You will need to forge the 401 response. One way is to do than is by:

{
    error_page 401 = @error401
    location @error401 {
        ...
        proxy_set_header WWW-Authenticate ...

    }