HTTP Basic Authentication provides a quick, simple password-protection layer for staging environments, admin tools, or internal resources — not a substitute for a real application-level auth system, but genuinely useful for its intended purpose.
When Basic Auth Is Appropriate
- Protecting a staging/development environment from casual public access
- Restricting access to internal tools without building a full login system
- Adding a quick additional layer in front of an application's own authentication
When It's Not Appropriate
Basic Auth sends credentials with every request (base64-encoded, not encrypted on its own — relies entirely on HTTPS for actual protection), has no session management, and no user-friendly login/logout flow — unsuitable as your primary application authentication mechanism.
Step 1 — Install the htpasswd Utility
sudo apt install apache2-utils -yDespite the Apache-related package name, this tool works for generating credential files used by both Nginx and Apache.
Step 2 — Create a Password File
sudo htpasswd -c /etc/nginx/.htpasswd myuser-c creates a new file — omit it when adding additional users to an existing file, since it would otherwise overwrite the file.
Step 3 — Add Additional Users
sudo htpasswd /etc/nginx/.htpasswd anotheruserStep 4 — Configure Nginx
location /admin {
auth_basic "Restricted Area";
auth_basic_user_file /etc/nginx/.htpasswd;
}Step 4 (Alternative) — Configure Apache
<Directory "/var/www/html/admin">
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>Step 5 — Reload the Web Server
sudo nginx -t && sudo systemctl reload nginxStep 6 — Test
Visit the protected path — your browser should prompt for a username/password before displaying any content.
Protecting an Entire Site vs a Specific Path
server {
auth_basic "Restricted Site";
auth_basic_user_file /etc/nginx/.htpasswd;
location / {
# entire site protected
}
}Combining Basic Auth with IP Restrictions (Defense in Depth)
location /admin {
auth_basic "Restricted Area";
auth_basic_user_file /etc/nginx/.htpasswd;
allow YOUR_TRUSTED_IP;
deny all;
}Removing a User
sudo htpasswd -D /etc/nginx/.htpasswd usernameStoring the Password File Securely
sudo chmod 640 /etc/nginx/.htpasswd
sudo chown root:www-data /etc/nginx/.htpasswdRestrict readability to prevent unauthorized access to the (hashed, but still sensitive) credential file.
Common Errors
Prompt never appears despite configuration — verify the configuration is inside the correct location/directory block and that Nginx/Apache was actually reloaded after the change.
Correct password rejected — verify the password file path in your web server configuration exactly matches where htpasswd actually created the file.
Continue Reading
- How to Set Up a Staging Environment for an E-commerce Store
- VPS Hosting for Developers: Setting Up a Dev/Staging Environment
- Understanding HTTP Security Headers (CSP, HSTS, X-Frame-Options)
Browse more articles in Web Servers.
