Apache- trying to add Authentication header to proxy request

Question

We have an Angular app hosted on Apache that is going through QA testing. The app communicates with an app server hosting our web services via a reverse proxy setup in Apache's httpd.conf:

ProxyPass /SVCS/ https://dev.mycompany.test/SVCS/
ProxyPassReverse /SVCS/ https://devws.mycompany.test/SVCS/

We noticed the original developer hard-coded the Basic Auth header the downstream web services require in the JavaScript. We want to remove this from the web app and instead have Apache append the Basic Auth header in the proxied request.

<IfModule mod_headers.c>
    Header add Access-Control-Allow-Origin: "*"
    Header set Access-Control-Allow-Methods: "OPTIONS, GET"
    Header set Access-Control-Max-Age: 1
    Header set Access-Control-Allow-Credentials: true
    Header set Access-Control-Allow-Headers: "authorization, X-my-header, X-your-header"
    RequestHeader set Authorization "Basic FOOBAR123ZZZZZZZZZZZZZZZZZZZZZ="
</IfModule>

This IfModule snippet was already in the file, I just added the RequestHeader line (obfuscated here). As soon as this is added, the browser starts prompting for a username/password "Authentication Required". I tried setting the Access-Control-Allow-Credentials=false but there was no effect. The Basic auth user/password is a service account created for the app to access the web services, we don't want the end user to have to enter anything, they are already authenticated via SSO from another app.

How can I get the basic auth added to the proxied request's headers and not prompt the user for a password?

I tried something along the lines of this post apache-basic-authentication-issue-with-reverse-proxy which essentially configures a password file. But that wasn't working, even when entering the correct password the service was returning a 401 not authorized (plus I don't want the user to have to enter anything)

Eric Soyke Eric Soyke · Accepted Answer · 2017-05-17T18:59:53

The authentication prompt was due to the fact I was setting the Authentication header for ALL requests instead of just the one service that required it. There was a followup service called that if I add the Auth header to, the server was complaining about the Authentication. I was able to narrow the setting of the header to this service only (via RewriteCond and RewriteRule) and all is well.

Apache- trying to add Authentication header to proxy request

1 Answers