Rails 3, Authlogic, NGINX and HTTP basic authentication no working nicely together

Question

I am in the early stages of building an app using Rails 3. User authentication is powered by Authlogic which I have setup pretty much as standard (as per the example docs) and everything is working as expected locally.

I have just deployed the app to a clean server install of Centos 5.4 / NginX / Passenger so staff can start to log in and enter content, etc. However, we're a long way from this being ready for public eyes so I have used NginX's basic auth module to keep the entire site behind another level of authentication.

Unfortunately Authlogic's authentication and NginX's basic authentication seem to be conflicting with one another. If basic auth is on then it is impossible to log in with Authlogic, yet if I disable basic auth then Authlogic works as expected.

I haven't posted any code as I'm really not sure what code would be relevant. I wonder whether this is a known issue and if there is any changes I can make to the configuration to get round the issue?

Answer 1

I still didn't try Rails 3, so my answer will be more general. And I don't know basic auth module for NginX.

1. If your team is connected localy, then you can create server accessible from local network only.
2. If you need access via Internet, then you can hide it behind VPN.
3. You can set access to site only through local ip and give ssh access to anybody who need it. It is easy to create socks proxy via ssh (in linux: ssh -D 8080 [email protected]; where 8080 is port number, then set socks proxy in browser and you can lunch yoursever.com:3000).
4. I think that NginX allows you to set allowed IP's and deny other - so you can use it also for access restriction.
5. And also you can temporarly add to ApplicationController before_filter :require_login :), so only login page will be availbe to the world.

Hope it helps!

Answer 2

I can answer my own question (after several hours of looking in completely the wrong place). A good readup on Authlogic::Session::Config did the trick.

class UserSession < Authlogic::Session::Base
  allow_http_basic_auth false
end