I had a working Traefik 2.0 installation with HTTP Basic Auth for a few services with no issues across client browsers. I have upgraded the installation to use HTTP Digest Auth, and this is working fine via Safari which correctly sends saved credentials for sub-pages. However, on Chrome I get many repeated prompts for credentials even when I click to save them - if you have the patience everything works if you keep re-keying credentials but this is non-viable on a refreshing dashboard obviously.
Has anyone experienced this, and can they suggest a configuration which avoids this problem? In debugging this I have logged out of Chrome, cleared its cached data etc to ensure it wasn't saving/re-using any old HTTP Basic Auth credentials. Behaviour is same on Chrome whether on Mac or Windows. Similar behaviour also on IE (haven't tried Edge). I have also curl'ed the endpoints in verbose mode to see whether there are any returned HTTP headers that I should be propagating but as best as I can tell there are none with HTTP Digest Auth.
Obviously, I should be moving to a proper auth method...and keycloak does look like a good way for me to achieve this...but I would like to get this working as-is if possible.
Would you be able to start with posting your full configuration that reproduces the issue? If you do I could try and run it myself and see if I get the same issue, or if I can spot anything wrong with the configuration itself.
Hello @fifofonix , sorry for the delay. You also reference dynamic_conf.toml but I cannot see it posted. I'll try without it but may not arrive to the same results.
You specify providers.docker.network to be dev_internal and yet, this is the not the network, where your containers are on.
"traefik.http.routers.prom-sec.rule=Host(`${ENV_FIRST_CHAR}-foo.bar`pdm) && PathPrefix(/metrics)" - This is not a correct syntax pdm hanging after the apostrophe sign like that.
For whoami it works. For the dashboard on chrome it floods you with never ending stream of authentication prompts. @ldez would you like to comment if we are doing anything wrong, before I open a github issue?
@ldez It is slightly better with your configuration when using host rules, however I'm still getting pop us every few seconds on chrome.
Do not worry about the router on the api - this is to model an external to traefik application, this is not a best practice guide. I wanted a minimal example, so instead of choosing an exteranl app to demonstrate that with, I used the dashboard you know very well. However I wanted to configure it the same way as I would configure any other application, that is without using the magic api@internal service.
I could have done spinning a second traefik instance with api@internal and then pointing the router in the main instance to a service pointing that that second instance, I wanted a setup to remain relatively simple though, so I have not done that.
Also if you want to route the API with path only, you have to add /api to the routes.
Yes, sorry, I missed that one. I tested with the /api too locally initially, and it also produced the pop ups, so I removed the /api. Now, when you pointed that out to me that the dashboard relies on the api, I'll make sure to keep it.
With 2.1, api@internal is now less magical, because we created a concrete internal provider, and the services, routers and middlewares of this provider now appear in the dashboard/api:
No, in your example, uncommenting the host based rule and commenting the paths one I still get pop ups every few seconds in chrome.
I also changed whoami.localhost to whoami.internal and dashboard.localhost to dashboard.internal, since my desktop is windows and I'm running docker elsewhere - but that should hardly matter.
Thanks for confirming replication of this issue and linking it on GitHub. Is it not bizarre that this works on Safari and even on iPad Chrome? Do we think this is actually therefore more of a browser compatibility/handling issue as opposed to a Traefik bug? Not isolated to desktop chrome however as also occurs on IE.
@ldez's input on secure dashboard also useful for me personally, as I now better understand the magic piece. Good to hear that is being addressed in future releases to increase transparency.
@zespri, I meet the same problem and was unable to find a solution on the web (neither on stackoverflow or github).
Indeed I have Traefik in front of three applications, I have two applications that use digest-auth and the last one with no digest-auth. And when I restart the docker with no digest-auth, I always have a popup to ask me to login on the two others applications (that used digest-auth). This happens on Chrome and Mozilla, and I don't understand why each time I restart a docker all the containers with digest-auth "reset" the digest-auth ... Is there any solution ? Or maybe I misunderstanging the documentation and miss something ?
I checked the Traefik logs, and I can see that each time I restart a docker that is expose via traefik but without middlewares, traefik recreates all the midllewares (and so all the digest-auth). Is there a way to restart a docker exposed on Traefik without recreating all the digest-auth middlewares ?
Bit late: for me the problem was I used both a Host match and a PathPrefix in the same rule. Since I use a dedicated subdomain for the dashboard anyway I simply removed the PathPrefix and now it also works in Google Chrome
