# How to use basic auth on all domains and add exception to one with a path?

**URL:** <https://community.traefik.io/t/how-to-use-basic-auth-on-all-domains-and-add-exception-to-one-with-a-path/12104>\
**Category:** Traefik v2\
**Tags:** docker-swarm, middleware, docker\
**Created:** [October 14, 2021, 1:09pm UTC](https://community.traefik.io/t/how-to-use-basic-auth-on-all-domains-and-add-exception-to-one-with-a-path/12104 "2021-10-14T13:09:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![asrob](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/asrob/32/140_2.png) [@asrob](https://community.traefik.io/u/asrob)\
**Post date:** [October 14, 2021, 1:09pm UTC](https://community.traefik.io/t/how-to-use-basic-auth-on-all-domains-and-add-exception-to-one-with-a-path/12104/1 "2021-10-14T13:09:11Z")

</div>

I have some domains and want to use basic auth on them.  
Here is my relevant part of docker-compose.yml:

```auto
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        - "traefik.http.routers.staging-http.rule=
          Host(`domain-1.staging.tld`) ||
          Host(`domain-2.staging.tld`) ||
          Host(`domain-3.staging.tld`) ||
          Host(`domain-4.staging.tld`) ||
          Host(`domain-5.staging.tld`) ||
          Host(`domain-6.staging.tld`) ||
          Host(`domain-7.staging.tld`)"
        - "traefik.http.routers.staging-http.entrypoints=http"
        - "traefik.http.routers.staging-http.service=staging"
        - "traefik.http.routers.staging-http.middlewares=https-redirect@file"
        - "traefik.http.routers.staging.rule=
          Host(`domain-1.staging.tld`) ||
          Host(`domain-2.staging.tld`) ||
          Host(`domain-3.staging.tld`) ||
          Host(`domain-4.staging.tld`) ||
          Host(`domain-5.staging.tld`) ||
          Host(`domain-6.staging.tld`) ||
          Host(`domain-7.staging.tld`)"
        - "traefik.http.routers.staging.entrypoints=https"
        - "traefik.http.routers.staging.service=staging"
        - "traefik.http.routers.staging.middlewares=basic-auth@file,https-redirect@file"
        - "traefik.http.routers.staging.tls=true"
        - "traefik.http.routers.staging.tls.certresolver=letsencrypt"
        - "traefik.http.routers.staging.tls.options=default"
        - "traefik.http.routers.staging-no-auth.rule=(Host(`domain-7.staging.tld`) && PathPrefix(`/api/`))"
        - "traefik.http.routers.staging-no-auth.entrypoints=http,https"
        - "traefik.http.services.staging.loadbalancer.server.port=80"
        - "traefik.http.services.staging.loadbalancer.passhostheader=true"

```

So, I would like to use basic auth for all of my staging sites but I would like to add an exception for domain-7.staging.tld on path "/api/\*".

How can I do that? What's wrong with my config?

Thanks!

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 17, 2021, 5:46pm UTC](https://community.traefik.io/t/how-to-use-basic-auth-on-all-domains-and-add-exception-to-one-with-a-path/12104/2 "2021-10-17T17:46:09Z")

</div>

You don't have a problem description here. What is working/not working. What are the expected vs actual results.

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 17, 2021, 8:20pm UTC](https://community.traefik.io/t/how-to-use-basic-auth-on-all-domains-and-add-exception-to-one-with-a-path/12104/3 "2021-10-17T20:20:21Z")

</div>

FYI I would create this deployment like the below, for a couple of users I'd create the basic-auth middleware in docker labels, otherwise I'd use the file.

> **docker-compose.yaml**
>
> ```yaml
> version: "3.8"
> 
> services:
> traefik:
> image: "traefik:v2.5"
> command:
> - --entrypoints.web.address=:80
> - --entrypoints.web.http.redirections.entrypoint.to=websecure
> - --entrypoints.web.http.redirections.entrypoint.permanent=true
> - --entrypoints.websecure.address=:443
> - --entrypoints.websecure.http.tls=true
> - --providers.docker=true
> - --providers.docker.exposedbydefault=false
> - --providers.file.filename=/dynamic.yaml
> - --accesslog
> - --accesslog.format=json
> - --api
> - --log.format=json
> labels:
> traefik.enable: "true"
> traefik.http.routers.api.rule: Host(`traefik.localhost`)
> traefik.http.routers.api.service: api@internal
> 
> ports:
> - published: 80
> target: 80
> - published: 443
> target: 443
> volumes:
> - "/var/run/docker.sock:/var/run/docker.sock:ro"
> - "./dynamic.yaml:/dynamic.yaml"
> whoami:
> image: traefik/whoami
> labels:
> traefik.enable: "true"
> traefik.docker.network: proxy
> traefik.http.routers.staging.rule: HostRegexp(`{sub:domain-[0-9]+}.staging.tld`)
> traefik.http.routers.staging.middlewares: basic-auth@file
> traefik.http.routers.staging-no-auth.rule: Host(`domain-7.staging.tld`) && PathPrefix(`/api/`)
> # if this rule was lower priority then the staging rule(as it was with the multiple OR )
> # traefik.http.routers.staging-no-auth.priority: 300
> 
> ```

> **dynamic.yaml**
>
> ```yaml
> http:
> middlewares:
> basic-auth:
> basicauth:
> users:
> - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
> 
> ```

When I set this up I did think you might be running into the rule priority order, I left the fix for that as a comment in the docker-compose.