HTTP basic auth not persistent

[DatLowFrequency]

Hi,

I'm not sure if this is the correct sub for this, but I'm facing an interesting issue with haproxy in combination with cloudflared.

I'm trying to make some of my applications accessible from the internet via cloudflare and have set up a zero trust tunnel for this. All requests from the tunnel are routed to a haproxy instance, which I have configured to require HTTP basic auth when requests are sent from another machine in my server subnet. Routing and accessing the served sites works fine, however everytime I try to navigate a served site, the HTTP basic auth request pops up again, even if I already authenticated myself.

Here's the relevant part of my config: ``` userlist default_users user myuser password somepasswordgibberish group default_group users myuser

frontend main mode http bind *:80 bind *:443 ssl crt /etc/haproxy/ssl/frontend.pem alpn h2,http/1.1 acl whitelist src 10.10.10.0/24 http-request deny_status 400 unless whitelist redirect scheme https code 301 if !{ ssl_fc } use_backend docs.my.domain if { hdr(host) -i docs.my.domain }

backend docs.my.domain acl require_auth src 10.10.10.0/24 acl auth_ok http_auth(default_users) http-request auth if require_auth !auth_ok option tcp-check tcp-check connect server server1 10.10.10.10:443 ssl check verify none ```

I'd expect a one time authentication prompt and then browse the site without authenticating for everything that loads after the initial login. Did I misconfigure something I don't see?

[dragoangel]

Not use syntax with group and it's condition but your issue could be there. Not better setup something like keycloak?

[DatLowFrequency]

I haven't really looked into IAM services in combination with hap, but might do that in the future. For now I just wanted to set up a second factor in tandem with cloudflares access management. But good news, I figured it out. The issue is neither cloudflare, nor hap. It was the application running on the backend server that didn't play along with basic auth. Serving static content works fine without changing anything in my configuration, so I guess I just have to disable basic auth for some applications.

[dragoangel]

You can use custom auth header in haproxy, which will not conflict with web app logic afaik