Basic Auth

Authenticate requests using HTTP Basic Authentication (RFC 7617)

Category: Setup-dependent integration
Task: Authenticate requests using HTTP Basic Authentication (RFC 7617)

Prerequisites: The external service, credentials, or certificates referenced by this configuration.

This configuration comes from the selected release. The example has not been run here; external services are not bundled.

Download the source file.

# Basic Authentication
#
# Authenticate requests using HTTP Basic Authentication (RFC 7617).
# Credentials are validated against an inline list of username/password
# pairs. Unauthenticated requests receive a 401 response with a
# WWW-Authenticate challenge header. The Authorization header is
# stripped before forwarding to prevent credential leakage upstream.
#
# ⚠️  EXPERIMENTAL: This example uses the `basic-auth-filter` experimental feature.
# Not recommended for production use. Build with --features basic-auth-filter.
#
# Usage:
#   cargo run -p praxis-proxy --features basic-auth-filter -- -c examples/configs/security/basic-auth.yaml
#
# Exercise:
#   curl http://localhost:8080/                  # 401 Unauthorized
#   curl -u admin:secret http://localhost:8080/   # 200 OK
#   curl -u readonly:viewer http://localhost:8080/ # 200 OK
#   curl -u admin:wrong http://localhost:8080/    # 401 Unauthorized

listeners:
  - name: default
    address: "127.0.0.1:8080"
    filter_chains:
      - main

filter_chains:
  - name: main
    filters:
      - filter: basic_auth
        realm: "Praxis Example"
        strip_authorization: true
        credentials:
          - username: admin
            password: secret
          - username: readonly
            password: viewer

      - filter: router
        routes:
          - path_prefix: "/"
            cluster: backend

      - filter: load_balancer
        clusters:
          - name: backend
            endpoints:
              - "127.0.0.1:3000"

insecure_options:
  allow_private_endpoints: true # example proxies to local backends