Basic auth is going away in chrome. What now? reddit / selfhosted ---------------------------------------------------------------------- xupetas · 2023-11-09 17:11 Hi all, I have been seeing in several companies that i support that the basic auth method is being disabled on the company browsers. As such, i am now unable to get access to my sites that are behind basic auth from that location - ie, the auth dialog window does not show and goes immediately into a 401 not authorized. I don't want to go the app-auth way (because i would have to rely on the security of the app itself, and thus more work to maintain my stuff), and would prefer something like mod_auth_form all packaged up in a reverse proxy docker container so it would be easier to plan a deployment. Does anyone know of such a container that does reverse proxy, and form authentication? Remember, basic auth is a no-no. Thanks! ---------------------------------------------------------------------- realorangeone · 2023-11-09 17:19 Tools like Authentik and Authelia can do "forward auth", which you can add in most reverse proxies to delegate auth to - works nicely. Your title is a little clickbait-y - basic auth isn't going away in Chrome at all, it's just being disabled by the companies you work with. Basic auth itself is a huge core component of HTTP, I doubt it's going anywhere any time soon. ---------------------------------------------------------------------- xupetas · 2023-11-09 17:49 I think it’s strange that all those companies that have nothing related to each other just started all to implement this. I genuinely think that something is going on to make them so this at the same time. I sincerely hope that you are right and this is just me being over nervous, but I don’t want to get caught with my pants down ---------------------------------------------------------------------- azukaar · 2023-11-09 18:00 Cosmos does this: [https://github.com/azukaar/Cosmos- Server/](https://github.com/azukaar/Cosmos-Server/) PS: I am the dev ---------------------------------------------------------------------- tomc128 · 2023-11-09 20:21 I was so concerned for a minute lol, I couldn't imagine them getting rid of basic auth. ---------------------------------------------------------------------- tomc128 · 2023-11-09 20:22 Another option for a simple Auth provider is nforwardauth https://github.com/nosduco/nforwardauth. Works great for me and is really simple ---------------------------------------------------------------------- zoredache · 2023-11-09 20:44 > I think it’s strange that all those companies that have nothing related to each other just started all to implement this. I Not that strange. Companies want cyber insurance. Lots of cyber insurance providers want companies to implement stronger authentication and access control. Dropping basic auth in favor of something that supports 2FA, passkeys, hardware tokens and so on is going to keep spreading. ---------------------------------------------------------------------- user01401 · 2023-11-10 01:17 Basic auth over https is encrypted. ---------------------------------------------------------------------- VeronikaKerman · 2023-11-10 08:04 Wait, what? Are they really removing http(s) basic authentication support from Chrome? ---------------------------------------------------------------------- xupetas · 2023-11-10 08:43 Well after all the comments here i am not sure. I got information from several companies that they are tuning their browsers do disallow for basic auth, because google is taking that away soon and they want the users to change the auth on their apps to something more modern. I also got the same reply at a dev private group. At present i am unsure tbh, but i am not gonna wait to find out ---------------------------------------------------------------------- VeronikaKerman · 2023-11-10 08:54 I only heard that they are removing (already did) basic authentication from Email protocols (imap/smtp), but not the web browsers.