Do not require HTACCESS login/password on API requests for .net

[teolemon]

Task

• Do not require HTACCESS login/password on API requests for .net as it forces developers to tweak behaviors between prod and staging, bringing challenges for debugging, CI, implementation…

Part of

• API (Tracker) #5523

cc @raphael0202

[alexgarel]

@teolemon can we be more precise ? It's about calls to /api/, that's it ?

[teolemon]

yes

[hangy]

Some API requests also go to cgi/image_something.pl.
What's the original intention for the htaccess login @stephanegigandet? Could it also be replaced with some warning in the website, which tells users that they're working in a staging environment?
That might be easier to understand than some files being protected with basic auth, while others are accessible.

[stephanegigandet]

@hangy the intention was to make sure it is not crawled and indexed by search engines

[stephanegigandet]

I remove the authentication in the proxy for queries to .net that start with /api/ or /cgi/

@proxy:/etc/nginx/conf.d# git diff
diff --git a/nginx/conf.d/openfoodfacts.net.conf b/nginx/conf.d/openfoodfacts.net.conf
index 8fbe027..f722e46 100644
--- a/nginx/conf.d/openfoodfacts.net.conf
+++ b/nginx/conf.d/openfoodfacts.net.conf
@@ -5,7 +5,6 @@ server {
 
     # Require an "off" username and "off" password to make sure the site is not
     # indexed by search engines
-    auth_basic "login and password: off";
     auth_basic_user_file /etc/nginx/off.htpasswd;
 
     access_log  /var/log/nginx/openfoodfacts.net.log  main;
@@ -16,6 +15,23 @@ server {
         proxy_buffering off;
         proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
+       # require authentication so that it is not crawled by robots
+       auth_basic "login and password: off";
+    }
+
+    # Do not require authentication for the API
+    location /api/ {
+        proxy_pass http://10.1.0.200:80/api/;
+        proxy_buffering off;
+        proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header Host $host;
+    }
+
+    location /cgi/ {
+        proxy_pass http://10.1.0.200:80/;
+        proxy_buffering off;
+        proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header Host $host;
     }
 
     listen 443 ssl; # managed by Certbot
@proxy:/etc/nginx/conf.d# git commit -m "remove authentication for .net API requests" openfoodfacts.net.conf 

[alexgarel]

Perfect !