Basic Auth

basic-auth validates the standard Authorization: Basic ... header against one configured username/password pair.

When to Use

• Small internal pages that benefit from the browser's native login prompt.
• Low-frequency admin endpoints without IAM or SSO integration.
• Temporary diagnostics protected together with IP Allow.

Behavior

The gateway expects Authorization to start with Basic and decodes the Base64 value into username:password. The decoded value must exactly match the configured pair.

Failures return 401:

• Missing header: {"error":"Missing Authorization header"}
• Wrong credentials: {"error":"Invalid credentials"}

Configuration

middlewares "auth-basic" {
  type     = "basic-auth"
  username = "admin"
  password = env("ADMIN_PASSWORD")
}

Notes

• Use TLS; Basic credentials are replayable if transported over plain HTTP.
• This is a single-user mechanism, not a multi-user audit or authorization system.
• Prefer printable ASCII credentials.
• For durable production access, prefer JWT or Forward Auth.

Recommended Order

middlewares = ["ip-allow", "auth-basic", "body-limit"]