Module ngx_http_auth_basic_module

The ngx_http_auth_basic_module module allows limiting access to resources by validating the user name and password using the “HTTP Basic Authentication” protocol.

Access can also be limited by address or by the result of subrequest. Simultaneous limitation of access by address and by password is controlled by the satisfy directive.

location / {
    auth_basic           "closed site";
    auth_basic_user_file conf/htpasswd;
}

auth_basic off;

Enables validation of user name and password using the “HTTP Basic Authentication” protocol. The specified parameter is used as a realm. Parameter value can contain variables (1.3.10, 1.2.7). The special value off cancels the effect of the auth_basic directive inherited from the previous configuration level.

Specifies a file that keeps user names and passwords, in the following format:

# comment
name1:password1
name2:password2:comment
name3:password3

The file name can contain variables.

Passwords are expected to be encrypted by the crypt() function. All password hashing methods as supported by the OS can be used. In particular, the following crypt() hashing methods are commonly available:

• MD5-based crypt() method, $1$;
• SHA256-based crypt() method, $5$;
• SHA512-based crypt() method, $6$.

Additionally, the following cross-platform password types are supported:

• hashed with the Apache variant of the MD5-based crypt() method ($apr1$);
• specified by the “{scheme}data” syntax (1.0.3+) as described in RFC 2307; supported schemes are PLAIN (an example one, should not be used), SHA (1.3.13) (plain SHA-1 hashing, insecure and should not be used), and SSHA (salted SHA-1 hashing, also insecure by today's standards).

Password hashes for common hashing methods can be generated using the “openssl passwd” command, for example:

$ openssl passwd -apr1 secret
$apr1$x/muFo1c$zwUN24M2TEq.6wg0AZacn0

$ openssl passwd -6 secret
$6$FjZ1ss8ytcGmrGFY$1fopTJLuLUGCRlv2YcRPIsZk9uaD9NBOGcKsUay/BLV3RR1ol0ONS08oPTVqA4XBkZ44M7OL4K6NjP9xPKShP0

Note that HTTP Basic Authentication implies password validation on each request, and password hashing method should be choosen with this in mind.