With the SecurityPolicy using basicAuth, I have the problem that the password prompt runs with every request.

[bitwelle]

I am using a HTTPRoute for different paths.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: backend-httproute
  labels:
    owner: "me"
spec:
  hostnames:
  - example.test
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: lb
    namespace: envoy-gateway-system
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /main/
    backendRefs:
    - group: ""
      kind: Service
      name: backend
      port: 80
      weight: 1
  - matches:
    - path:
        type: PathPrefix
        value: /data
    backendRefs:
    - group: ""
      kind: Service
      name: static-files
      port: 80
      weight: 1
  - matches:
    - path:
        type: PathPrefix
        value: /temp
    backendRefs:
    - group: ""
      kind: Service
      name: files
      port: 80
      weight: 1
  - matches:
    - path:
        type: PathPrefix
        value: /_assets
    backendRefs:
    - group: ""
      kind: Service
      name: backend
      port: 80
      weight: 1

policy

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: backend-basic-auth
  labels:
    owner: "me"
spec:
  basicAuth:
    users:
      group: ""
      kind: Secret
      name: basic-auth
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: backend-httproute

and also the secret basic-auth

The problem is that basic authentication is requested again for every file in _assets/.

_assets/1ee1d3e909b58d32e30dcea666dd3224/JavaScript/Contrib/bootstrap.js
_assets/081fa96a07de1dccb64a8a83e1567439/Css/backend.css?1773228283
_assets/081fa96a07de1dccb64a8a83e1567439/Css/webfonts.css?1773228283
_assets/f6ef6adaf5c92bf687a31a3adbcb0f7b/Css/Backend/RecordList.css?1773228278

Can I summarize this via the security policy? Or do I need to change something else in the routing?

[JoseDiazGomez]

Hello,

I have the same problem. Any solution for this?

[bitwelle]

I'm sorry for both of us.
In this case, I have Nginx behind it and the BA running on top of that.

Unfortunately, I don't have a proper Envoy solution for this and haven't found anything. Please let me know if you have a better solution or any suggestions.

[EmptyLungs]

@JoseDiazGomez @bitwelle Hey guys! I've also run into the same issue.
Envoy basic-auth security policy does not support cookies, and the browser only sends the cached Authorization header to paths under the directory where it first authenticated:
https://datatracker.ietf.org/doc/html/rfc7617#section-2.2

So I ended up implementing Path=/ cookie on the container proxy level, Apache in my case