# How to Bypass Basic Auth for Images with Traefik?

**URL:** <https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289>\
**Category:** Traefik v3 (latest)\
**Tags:** middleware\
**Created:** [June 22, 2024, 2:32pm UTC](https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289 "2024-06-22T14:32:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rudak](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rudak/32/8926_2.png) [@rudak](https://community.traefik.io/u/rudak)\
**Post date:** [June 22, 2024, 2:32pm UTC](https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289/1 "2024-06-22T14:32:41Z")

</div>

Hello Traefik Community,

I have a website protected by basic authentication, and I’m using Traefik as my reverse proxy. My issue is that I need to include images from this site in emails, but these images are blocked due to the authentication requirement.

**Current Setup:**  
I am using the following labels in my docker-compose.yml to configure Traefik:

```yaml
labels:
  - traefik.enable=true
  - traefik.http.routers.xxx-secured.entrypoints=websecure
  - traefik.http.routers.xxx-secured.rule=Host(`mydomain.com`)
  - traefik.http.routers.xxx-secured.tls.certresolver=myresolver

```

With this configuration, all routes are secured by Traefik's basic authentication. However, I need to make the /images/ path publicly accessible so that images can be viewed without requiring authentication, especially for email clients.

**Desired Outcome:**  
I want to allow public access to images located under /images/ while keeping the rest of the site behind basic authentication.

**Question:**  
How can I configure Traefik to bypass authentication for the /images/ path?  
Is it possible to use a middleware to achieve this, or is there a better approach?

**Example Labels or other stuff for Desired Configuration:**  
Could you provide an example of how to adjust my current labels to achieve this?

I appreciate any guidance or examples you can provide. Thank you!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 22, 2024, 2:43pm UTC](https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289/2 "2024-06-22T14:43:39Z")

</div>

You need a second `router` (and `service`) for images, without the auth `middleware`:

```auto
traefik.http.routers.xxx-images.rule=Host(`mydomain.com`) && PathPrefix(`/images`)

```

Because the `rule` is longer, it has a higher priority and will be matched first.

---

<div class="post-metadata">

**Author:** ![rudak](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/rudak/32/8926_2.png) [@rudak](https://community.traefik.io/u/rudak)\
**Post date:** [June 22, 2024, 8:46pm UTC](https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289/3 "2024-06-22T20:46:08Z")

</div>

My `abcdef-secured` service works perfectly, but when I add the `abcdef-images` service with `loadbalancer.server.port=80`, the router dont start.  
it's the commented section that's giving me trouble  
am I wrong?

```auto
services:

  nginx:
    image: 'nginx:latest'
    container_name: abcdef
    volumes:
      - ./nginx:/etc/nginx/conf.d
      - ./app:/var/www/html
    depends_on:
      - php
    labels:
      - traefik.enable=true
      - traefik.http.services.abcdef-secured.loadbalancer.server.port=80
      - traefik.http.routers.abcdef-secured.entrypoints=websecure
      - traefik.http.routers.abcdef-secured.rule=Host(`abcdef.link`)
      - traefik.http.routers.abcdef-secured.tls.certresolver=myresolver
      - traefik.http.routers.abcdef-secured.middlewares=auth@file

# - traefik.http.services.abcdef-images.loadbalancer.server.port=80
# - traefik.http.routers.abcdef-images.rule=Host(`abcdef.link`) && PathPrefix(`/images`)
# - traefik.http.routers.abcdef-images.entrypoints=websecure
# - traefik.http.routers.abcdef-images.tls.certresolver=myresolver

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 23, 2024, 5:41pm UTC](https://community.traefik.io/t/how-to-bypass-basic-auth-for-images-with-traefik/23289/4 "2024-06-23T17:41:33Z")

</div>

Working example, needs `service` definitions and assignments in labels:

```auto
services:
  traefik:
    image: traefik:v3.0
    ports:
      - 80:80
      - 443:443
    networks:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
      #- /var/log:/var/log
    command:
      - --api.dashboard=true
      - --log.level=INFO
      #- --log.filepath=/var/log/traefik.log
      - --accesslog=true
      #- --accesslog.filepath=/var/log/traefik-access.log
      - --providers.docker.network=proxy
      - --providers.docker.exposedByDefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entryPoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.asDefault=true
      - --entrypoints.websecure.http.tls.certresolver=myresolver
      - --certificatesresolvers.myresolver.acme.email=mail@example.com
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    labels:
      - traefik.enable=true
      - traefik.http.routers.mydashboard.rule=Host(`traefik.example.com`)
      - traefik.http.routers.mydashboard.service=api@internal
      - traefik.http.routers.mydashboard.middlewares=myauth
      - traefik.http.middlewares.myauth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/

  whoami:
    image: traefik/whoami:v1.10
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.rule=Host(`whoami.example.com`)
      - traefik.http.routers.mywhoami.middlewares=mywhoami-auth
      - traefik.http.routers.mywhoami.service=mywhoami
      - traefik.http.middlewares.mywhoami-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

      - traefik.http.routers.mywhoami-unsecured.rule=Host(`whoami.example.com`) && PathPrefix(`/unsecured`)
      - traefik.http.routers.mywhoami-unsecured.service=mywhoami-unsecured
      - traefik.http.services.mywhoami-unsecured.loadbalancer.server.port=80

networks:
  proxy:
    name: proxy

volumes:
  letsencrypt:
    name: letsencrypt

```