# Basic Auth on Specific Route Only

**URL:** <https://community.traefik.io/t/basic-auth-on-specific-route-only/3484>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [December 17, 2019, 7:22am UTC](https://community.traefik.io/t/basic-auth-on-specific-route-only/3484 "2019-12-17T07:22:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![saaymeen](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@saaymeen](https://community.traefik.io/u/saaymeen)\
**Post date:** [December 17, 2019, 7:22am UTC](https://community.traefik.io/t/basic-auth-on-specific-route-only/3484/1 "2019-12-17T07:22:55Z")

</div>

Hi, I came to an interesting setup that I would love to solve with Traefik, however, playing around with the docker labels hasn't helped much yet.  
We have a CMS available under cms.domain.tld and the corresponding admin panel available under cms.domain.tld/admin.  
The first domain must be publicly accessible without any issues with all routes but /admin (which should be protected through basic auth).  
I would like to only password protect the /admin route, where it is to be noted that once on the admin route, other routes like /query will be queried too.  
Anybody has an idea on how this can be solved?  
My idea was to have two services like this:

```auto
- "traefik.http.routers.cms1.rule=Host(`cms.domain.tld`)"
- "traefik.http.routers.cms1.service=cms1"
- "traefik.http.services.cms1.loadbalancer.server.port=1337"
- "traefik.http.routers.cms1.tls.certresolver=le"
- "traefik.http.routers.cms1.entrypoints=websecure"

- "traefik.http.routers.cms-admin.service=cms-admin"
- "traefik.http.routers.cms-admin.rule=(Host(`admin.domain.tld`) && PathPrefix(`/admin`))"
- "traefik.http.services.cms-admin.loadbalancer.server.port=1337"
- "traefik.http.routers.cms-admin.tls.certresolver=le"
# - basic auth here

```

This approach however does not work, because admin.domain.tld/admin will make queries on admin.domain.tld/query which of course does not match any route.

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [December 17, 2019, 9:01am UTC](https://community.traefik.io/t/basic-auth-on-specific-route-only/3484/2 "2019-12-17T09:01:09Z")

</div>

Hello,

```auto
      - "traefik.http.routers.cms1.rule=Host(`cms.domain.tld`)"
      - "traefik.http.routers.cms1.entrypoints=websecure"
      - "traefik.http.routers.cms1.tls.certresolver=le"
      - "traefik.http.routers.cms1.service=cms1"
      - "traefik.http.services.cms1.loadbalancer.server.port=1337"

      - "traefik.http.routers.cms-admin.rule=Host(`cms.domain.tld`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.cms-admin.entrypoints=websecure"
      - "traefik.http.routers.cms-admin.middlewares=auth"
      - "traefik.http.routers.cms-admin.tls.certresolver=le"
      - "traefik.http.routers.cms-admin.service=cms-admin"
      - "traefik.http.services.cms-admin.loadbalancer.server.port=1337"

      # auth middleware
      - "traefik.http.middlewares.auth.basicauth.users=user:password"

```

---

<div class="post-metadata">

**Author:** ![saaymeen](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@saaymeen](https://community.traefik.io/u/saaymeen)\
**Post date:** [December 17, 2019, 12:31pm UTC](https://community.traefik.io/t/basic-auth-on-specific-route-only/3484/5 "2019-12-17T12:31:10Z")

</div>

Clean and easy solution, thank you very much!