basic-auth
Asks visitors for a username and password before the request reaches your service.
| Phases | on_http_request |
| Terminating | No — the next action runs after it. |
| Cost | Free |
Example
policy.yaml
on_http_request:
- name: RequireBasicAuth
actions:
- type: basic-auth
config:
realm: staging
credentials:
- "alice:correct-horse-battery"
Start an agent endpoint with it: devgate http 8080 --traffic-policy-file policy.yaml, or paste it into a
reserved or cloud endpoint’s Traffic Policy tab in the dashboard.
Configuration
| Field | Type | Description |
|---|---|---|
credentials required | list of strings | Up to 10 username:password pairs. Passwords are 8 to 128 characters. |
realm | string | The realm the browser shows in its sign-in prompt. Default: devgate. |
enforce | boolean | When false, nothing is blocked: the action only records whether valid credentials were sent, for a later rule to act on. Default: true. |
Result variables
After it runs, later rules can read what it decided:
-
actions.ngrok.basic_auth.credentials.presented— Whether the request carried credentials at all. -
actions.ngrok.basic_auth.credentials.username— The username sent. -
actions.ngrok.basic_auth.credentials.authorized— Whether they matched one of the configured pairs.
Behaviour
- Without valid credentials the visitor gets 401 with a WWW-Authenticate challenge, and the browser shows its sign-in prompt.
- Credentials are compared in constant time.
Other actions
add-headers remove-headers compress-response oauth openid-connect jwt-validation custom-response deny redirect url-rewrite restrict-ips rate-limit circuit-breaker verify-webhook http-request set-vars log close-connection forward-internal