[Feature] Support basic auth in server endpoint URL

[jeverling]

The feature

I run all services behind a reverse proxy that adds SSL and basic auth, using https://github.com/SteveLTN/https-portal
This way I have to worry much less about security issues, compared to when services are directly exposed.

Providing basic auth credentials using https://username:password@my.immich.tld/api doesn't seem to work, there is a popup visible for a short moment with a 401 error. Without basic auth the connection works fine (via https through the reverse proxy).

I do not want to provide the immich user credentials within the URL, but additional basic auth credentials to prevent any unauthenticated access to the API endpoint.

Platform

• Server
• Web
• Mobile

[kocane]

I agree. Would be nice. Basic auth is a simple extra security layer.

[dekiesel]

This would be great to have!

[YosenFree]

I have the same need, it would be great if the author could add it

[jpg0]

I'd like this too. I'll have a go at adding it to the mobile apps.

#6617

[nephre]

+1 for this feature, I have the same setup

[JacobBrownAustin]

@nephre , this was added in #6840 .
Have you tried it?

[nephre]

Is there any documentation how to use it? I have user:password defined in htpasswd, how does it map to x-immich-user-token? android app does not accept https://user:app@my.immich.app/api URL when connecting.

[nephre]

Problems seem to be in # and $ characters that I have in my http password. When I type them raw, I get error from immich app that server URL is invalid. When I type my password urlencoded (with %23 in place of "#" character and %24 in place of "$"), I get invalid password message in server logs.
Is mobile app transforming http password somehow before sending it to server?

[bebehei]

In case you have special chars in your password you usually must urlencode them. Then basic auth should work. However change the password to match your entropy with longer strings, but smaller alphabet (like only [a-zA-Z0-9]).

[bebehei]

Well you've already done this. Sorry for the noise.

[bo0tzz]

Any problems with this are now tracked in #15230