[BUG] Basic Auth won't activate
Author: zynexizCreated Sep 16, 2026Updated Sep 18, 2026
Labelsbugneed more info
What happened?
I need to protect a admin interface on a service, under /admin, and tried enabling Basic Auth. But it seems that it doesn't want to get enabled. Have I missed something. The URI should be whitelisted when on internal network, but restricted on external. Blacklisting the URI doesn't seem to work either tho (maybe some issue with BLACKLIST_URI?).
How to reproduce?
Add Basic Auth for subpath.
Configuration file(s) (yaml or .env)
IS_DRAFT=no
SERVER_NAME=<DOMAIN>
USE_TEMPLATE=low
SECURITY_MODE=detect
USE_AUTH_BASIC=yes
AUTH_BASIC_LOCATION=/admin/
AUTH_BASIC_USER=adminuser
AUTH_BASIC_PASSWORD=abc123
USE_BAD_BEHAVIOR=no
BAD_BEHAVIOR_THRESHOLD=30
BAD_BEHAVIOR_BAN_TIME=3600
BLACKLIST_URI=^/admin/index.html
USE_CORS=yes
CORS_ALLOW_ORIGIN=*
WHITELIST_COUNTRY=SE
USE_CUSTOM_SSL=yes
CUSTOM_SSL_CERT=<HIDDEN>
CUSTOM_SSL_KEY=<HIDDEN>
USE_DNSBL=no
GZIP_PROXIED=expired no-cache no-store private auth
KEEP_UPSTREAM_HEADERS=*
CONTENT_SECURITY_POLICY=
REFERRER_POLICY=no-referrer-when-downgrade
PERMISSIONS_POLICY=
COOKIE_FLAGS=* SameSite=Lax
AUTO_LETS_ENCRYPT=yes
EMAIL_LETS_ENCRYPT=<HIDDEN>
LIMIT_CONN_MAX_HTTP1=25
LIMIT_CONN_MAX_HTTP2=200
LIMIT_CONN_MAX_HTTP3=200
LIMIT_REQ_RATE=10r/s
ALLOWED_METHODS=GET|POST|HEAD|OPTIONS|PUT|DELETE|PATCH|QUERY
MAX_CLIENT_SIZE=100m
USE_REVERSE_PROXY=yes
REVERSE_PROXY_HOST=http://10.x.x.x:x
WHITELIST_IP=10.0.0.0/8 172.16.0.0/16
WHITELIST_RDNS=
WHITELIST_ASN=Relevant log output
NoneBunkerWeb version
1.6.14
What integration are you using?
Linux
Linux distribution (if applicable)
Debian 13
Removed private data
- I have removed all private data from the configuration file and the logs
Code of Conduct
- I agree to follow this project's Code of Conduct
Source: bunkerity/bunkerweb