amazon alb and basic auth

Question

I have a simple site in fargate and an alb. I want to throw a simple basic auth on top of it - just a single hardwired username and password. Is there an easy way to do this?

I tried going to cognito - creating a user pool, and attaching it to the site, but there were questions like "callback url" - which i just set to the same url and "signout url" that I wasn't sure about and when I managed to click a set of things that allowed me to add it, and add a listener to my https endpoint - it just gives a "redirect_mismatch" when I try to get in.

Is there any way to do what I want without editing the underlying system in any way?

Answer 1

I did the following tests using ALB and CloudFront - HTTPS for Browsers only

1. Encode credentials user=user and password=password

   echo -n 'user:password' | base64
   
   dXNlcjpwYXNzd29yZA==
   

2. Create ALB with the listener rule HTTP header Authorization is Basic dXNlcjpwYXNzd29yZA==

3. Place ALB behind CloudFront and forward Authorization header

4. Test result using curl

   # Authentication option
   curl -u 'user:password' https://d3anlpzrykthss.cloudfront.net
   Hello from f86c5f9e0395
   
   # In-url password
   curl https://user:[email protected]
   Hello from f86c5f9e0395
   
   # Headers
   curl -H 'Authorization: Basic dXNlcjpwYXNzd29yZA==' https://d3anlpzrykthss.cloudfront.net
   Hello from f86c5f9e0395
   
   # Wrong password
   curl -u 'user:wrong' https://d3anlpzrykthss.cloudfront.net
   Not authorized
   

5. Not clear how to make it to work in Browsers - Can I use HTTP Basic Auth in URLs?

   # Firefox / Chrome / Safari
   https://user:[email protected]
   Not authorized