API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) · Lesson

Basic Authentication & Access Control

Set up basic HTTP authentication and IP-based access control to protect Nginx resources.

Basic Authentication & Access Control is a free API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Protecting Nginx Resources

When Nginx serves content or acts as a proxy, it's crucial to control who can access your resources. This helps prevent unauthorized access and keeps your applications secure.

In this lesson, we'll explore two fundamental ways to secure Nginx: Basic HTTP Authentication and IP-based Access Control.

Basic HTTP Authentication

Basic HTTP Authentication is a simple way to protect web resources using a username and password. When a user tries to access a protected resource, their browser will prompt them to enter credentials.

The browser sends credentials with each request.
Nginx verifies these against a stored file.
It's straightforward but sends credentials as base64 encoded text (not encrypted), so always use it with HTTPS!

Creating a Password File

To use basic authentication, Nginx needs a file containing usernames and encrypted passwords. We use the htpasswd utility, which is typically part of the Apache utilities package.

Here's how to create or add users to a password file:

sudo apt install apache2-utils  # On Debian/Ubuntu
sudo yum install httpd-tools   # On CentOS/RHEL

sudo htpasswd -c /etc/nginx/.htpasswd coddyuser
# -c creates the file if it doesn't exist
# You'll be prompted to enter and confirm password

Nginx Basic Auth Configuration

Once you have your password file, you can configure Nginx to use it. You'll use two main directives:

auth_basic: Sets the realm (a message shown in the login prompt).
auth_basic_user_file: Specifies the path to your password file.

These directives can be placed in http, server, or location blocks.

Example: Basic Auth with Nginx

This Nginx configuration snippet protects the /admin path, requiring users to authenticate with credentials from the .htpasswd file.

http {
    # ... other http settings

    server {
        listen 80;
        server_name example.com;

        location / {
            root /var/www/html;
            index index.html;
        }

        location /admin {
            auth_basic "Restricted Area";
            auth_basic_user_file /etc/nginx/.htpasswd;
            root /var/www/admin;
            index index.html;
        }
    }
}

IP-based Access Control

Another way to secure resources is by controlling access based on the client's IP address. Nginx uses the allow and deny directives for this.

allow IP_ADDRESS | CIDR | all: Permits access from specified IPs.
deny IP_ADDRESS | CIDR | all: Denies access from specified IPs.

These directives are processed in order within a block. The first matching rule applies.

Configuring IP Access Rules

You can specify single IP addresses, IP ranges using CIDR notation (e.g., 192.168.1.0/24), or all to refer to all IPs. Remember, the order matters!

For example, to allow a specific IP and deny all others, you'd list allow first, then deny all.

Example: IP Access with Nginx

This configuration allows access to /private only from 192.168.1.100 and any IP within the 10.0.0.0/8 network, denying everyone else.

http {
    # ... other http settings

    server {
        listen 80;
        server_name example.com;

        location / {
            root /var/www/html;
            index index.html;
        }

        location /private {
            allow 192.168.1.100;
            allow 10.0.0.0/8;
            deny all;
            root /var/www/private;
            index index.html;
        }
    }
}

Combining Access Controls

You can combine both basic authentication and IP-based access control for enhanced security. Nginx processes these rules sequentially.

First, IP-based rules are evaluated.
If access is allowed by IP, then basic authentication is checked.

This means a request must satisfy both sets of rules to gain access.

Quick Check: Nginx Security

Consider the following Nginx configuration snippet. A user with IP 192.168.1.50 tries to access example.com/sensitive. The .htpasswd file contains a valid entry for 'admin'.

What will happen?

location /sensitive {
    deny 192.168.1.0/24;
    allow 192.168.1.50;
    deny all;
    auth_basic "Secure Area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Recap: Nginx Access Control

In this lesson, you learned how to protect your Nginx resources using two key methods:

Basic HTTP Authentication: Uses username/password stored in an .htpasswd file, configured with auth_basic and auth_basic_user_file. Best used with HTTPS.
IP-based Access Control: Filters requests based on IP addresses using the allow and deny directives. Order of these rules is crucial.

These methods provide foundational security for your Nginx server and the applications it serves.

Frequently asked questions

Is the “Basic Authentication & Access Control” lesson free?

Yes — the full text of “Basic Authentication & Access Control” is free to read here on the web, and the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) course, upgrade to CoddyKit PRO.

What will I learn in “Basic Authentication & Access Control”?

Set up basic HTTP authentication and IP-based access control to protect Nginx resources. You practise API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)?

No prior experience is required. API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Basic Authentication & Access Control” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson?

Yes. Every API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway) lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to API Gateway & Reverse Proxy (Nginx + Spring Cloud Gateway)