Forum Discussion

iahiqosolutions's avatar
13 years ago

How to skip Staging Authorization for images?

Hello folks,

 

I'm developing web site that uses Lithium REST API.
One of pages of the web site should display user's posts.
Each of posts can contain images(that was uploaded in Lihthium) and user's avatar.
All works pretty good except one thing.
When browser tries to display images that hosted in Lithium or user avatars, it requires the credentials for HTTP Basic Authentication.

My question is: have I any chance to skip Staging Authorization for images and avatars?


Here is examples of url for avatar and image:

 

http://%communityName%.stage.lithium.com/t5/image/serverpage/avatar-name/hippo/avatar-theme/candy/avatar-collection/animals/avatar-display-size/message

 

http://%communityName%.stage.lithium.com/t5/image/serverpage/image-id/17i25BBB5358B3A3694/image-size/original?v=mpbl-1&px=-1

 

P.S.
I can pass the authentication check for REST API calls, but I cannot do that for the images that can be included in a message body text.

  • The basic auth check is there to prevent search engines like google from indexing the stage site, so you want to leave it on.  It won't be on for your production site (as you want the search engines to index that), but it should be on for your staging site.  What you might want to do is use a variable of some kind that tells you if your site is pointed to your Lithium stage site vs. your Lithium prod site.  Based on that variable, your site could include the appropriate URL and if the Lithium site is your stage site you could also include the appropriate  Authorization or WWW-Authenticate header for basic auth to the stage site.

2 Replies

  • DougS's avatar
    DougS
    Khoros Oracle
    13 years ago

    The basic auth check is there to prevent search engines like google from indexing the stage site, so you want to leave it on.  It won't be on for your production site (as you want the search engines to index that), but it should be on for your staging site.  What you might want to do is use a variable of some kind that tells you if your site is pointed to your Lithium stage site vs. your Lithium prod site.  Based on that variable, your site could include the appropriate URL and if the Lithium site is your stage site you could also include the appropriate  Authorization or WWW-Authenticate header for basic auth to the stage site.

  • Hello DougS,

    thank you for your reply.
    But as far as I know, if you want to deny access to a website you should simple prepare corresponding robots.txt file.
    Therefore using basic authentication for denying access to the website for search-bots sounds like overkill.