Nginx · The edge of your stack
How do you add HTTP basic authentication?
Short answer
Set auth_basic to a realm name and auth_basic_user_file to an htpasswd file. Always serve it over TLS because credentials are only base64-encoded, not encrypted.
Basic authentication is simple and useful for internal tools, staging sites and admin panels. Nginx checks the Authorization header against the user file on each request, so the file must remain readable by the worker user.
location /admin/ {
auth_basic "Admin area";
auth_basic_user_file /etc/nginx/.htpasswd;
try_files $uri $uri/ =404;
}Creating and combining users
- Create the file with htpasswd -c /etc/nginx/.htpasswd username
- Use htpasswd without -c to add more users
- bcrypt hashes are stronger than legacy apr1 or MD5 entries
- satisfy any lets either IP allow or basic auth grant access; the default requires both
- auth_request delegates authentication to an external service for SSO or token checks
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why is basic auth unsafe without TLS?
- 2How do you add a user to an existing htpasswd file?
- 3What is the difference between auth_basic and auth_request?
- 4How would you combine basic auth with an IP allowlist?
Say it in the interview
I set auth_basic and point auth_basic_user_file at an htpasswd file created with the htpasswd tool. I always put it behind TLS because the credentials are only base64 encoded. For internal tools it is quick and effective, but it has no logout or fine-grained authorization, so for real users I use an application session or an external auth service through auth_request.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Nginx mock interview and get scored feedback on depth, clarity and confidence.