In a discussion titled ‘Staging a new community: Basic Auth breaks WP-Discourse plugin,’ Todd_S reports that enabling HTTP Basic Authentication on both WordPress and Discourse servers breaks the WP-Discourse plugin, resulting in a 401 Unauthorized error. The plugin fails because it cannot authenticate with the protected Discourse API. pfaffman suggests that Discourse may not work reliably behind Basic Auth and recommends alternatives like setting ‘login required’ or using IP-based firewall rules. He also proposes allowing API access by whitelisting the WordPress server’s IP in Discourse’s Nginx config. Todd_S confirms this solution worked: he modified the app.yml file to conditionally disable Basic Auth for specific IPs (including WordPress’s public IP) using Nginx’s geo directive and ensured the /srv/status endpoint remains unauthenticated. After rebuilding, the plugin successfully connects, displaying a green ‘You are connected to Discourse!’ message. This workaround allows staging environments to remain protected while preserving plugin functionality.
I am staging Wordpress and Discourse sites (self-hosted) using the WP-Discourse plug-in.
I have successfully enabled HTTP Basic Authentication on both sites to keep them from being accessible until they are ready to go public (effectively blocking access from the general public as well as search engines).
Wordpress (informational for folks looking to accomplish something similar)
Created .htpasswd file with a user and corresponding password
The WP-Discourse plugin works well until basic authentication is enabled on the Discourse server.
(Edit) This is the error in the WP-Discourse plugin log on the Wordpress end: [2025-02-14 18:20:06] connection.INFO: check_connection_status.failed_to_connect {"error":"wpdc_response_error","message":"An invalid response was returned from Discourse","http_code":401,"http_body":"<html>\r\n<head><title>401 Authorization Required</title></head>\r\n<body>\r\n<center><h1>401 Authorization Required</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n"}
Any thoughts on how to exclude APIs from requiring HTTP Basic Authentication on Discourse?
Have you though? I’m not entirely sure that Discourse will work behind basic auth; I tried once but gave up. It seems even more likely that it might break wp-discourse (oh, and I was right about that!). If you were successful, you’d not be writing this message.
For Discourse staging sites, I generally just set “login required” and that keeps away search engines. Someone with a login can still log in, but that’s usually what you want.
If it’s unacceptable that your sites are available to anyone then maybe you should use a firewall and limit access to your IP.
Thanks, this clue helped me solve the issue. Here is the updated basic auth section of app.yml on my Discourse server (no changes were necessary on the Wordpress server):
# basic auth
after_bundle_exec:
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# Allow bypass cache from localhost"
to: |
# Allow bypass basic authentication for WP-Discourse plugin
geo $authentication {
default "Credentials you must provide.";
127.0.0.1 "off";
151.101.3.55/32 "off";
}
# Allow bypass cache from localhost
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic on"
to: "auth_basic $authentication"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "# auth_basic_user_file /etc/nginx/htpasswd"
to: "auth_basic_user_file /etc/nginx/htpasswd"
- replace:
filename: "/etc/nginx/conf.d/discourse.conf"
from: "location = /srv/status {"
to: "location = /srv/status {
auth_basic off;"
- file:
path: "/etc/nginx/htpasswd"
contents: |
alfred:$apr1$jSdLuHyZ$faWxYGjnmLd/zRC6UMsRs1
151.101.3.55 is the (example) public IP address of my Wordpress server. WP-Discourse now reports:
