Unsolved Password protect access to forum

[mattdjuk]

Hi
I want to password protect access to my forum - so a prompt for creds in advance of even seeing the forum. I have added this feature in NGINX, and it does what I expect in terms of prompting before access. My problem is, that when I add this, I get caught in a loop with the following message continously displayed:

"It looks like your login session is no longer active. Please refresh this page."

I am then unable to login, or even read the forum without this message appearing.

What can I do about this? Is there another way to protect access?

Thanks in advance
M

[PitaJ]

Share your nginx config please

[phenomlab]

@mattdjuk This might be a cleaner way

Jan 4  /  Admin Control Panel

Force User Login

Hide content from non-logged in users and redirect them to the login page. Log into your forum as an Admin Open the Admin Control Panel, you can do this via the gears icon or by appending "/admin" to your forum URL Open the "Appearance > Custom Content (...

[Normando]

@phenomlab wowwww, it is new??? Very nice

[phenomlab]

@Normando Dunno - I stumbled across it a while back looking for something else

[julian]

@phenomlab one could argue that there is nothing cleaner than basic auth from a web server

[phenomlab]

@julian true, yes, but cleaner in my view at application level

[gotwf]

@julian said in Password protect access to forum:

@phenomlab one could argue that there is nothing cleaner than basic auth from a web server

@phenomlab said in Password protect access to forum:

@julian true, yes, but cleaner in my view at application level

Certainly both can be argued as true. My understanding of security best practices is generally speaking to block the bad stuff as far upstream as operationally feasible. Hence, if asked, I would recommend enforcing at the web sever level.

Additionally, in keeping with best practices, had I cause to be extra paranoid and/or protecting some "higher" value asset, I would recommend also enforcing/checking the policy once again at the app level. Layered onions, and all that.

So, like many things, not a simple either/or. Unless you want it to be? Seeing the simplicity in the complex is also desirable trait cuz your security posture also needs to be maintainable. For you and your resource commitment levels, eh?

Have a groovy day.