Search code examples
apachemod-proxybasic-authentication

Remove basic authentication header with apache mod proxy

I have a HTTP Basic secured website. I hide a Tomcat application server with mod_proxy. Can I remove the HTTP Basic header? The Tomcat application reads the header and returns 401 not authorized. Basic auth isn't needed because the application uses cookie sessions. So I think just removing the headers would be fine.

Solution

  • Make sure mod_headers is enabled. An example config:

    <VirtualHost *:80>
        ServerName something.example.com
        ServerAdmin [email protected]

        ProxyRequests Off
        ProxyPreserveHost Off
        AllowEncodedSlashes On
        KeepAlive Off

        <Proxy *>
            Order deny,allow
            Allow from all
        </Proxy>

        <Location />
                AuthType Basic
                AuthName "Authorized Users Only"
                AuthUserFile /etc/apache2/passwd
                Require valid-user
        </Location>

        RequestHeader unset Authorization
        ProxyPass / http://localhost:5984/ example
        ProxyPassReverse / http://localhost:5984/

        ErrorLog /var/log/apache2/something.example.com-error_log
        CustomLog /var/log/apache2/something.example.com-access_log common
</VirtualHost>