Composer Authentication requires

[andreibsl]

Hey, we're disabling the auth for the custom composer repo. On the front-end it works fine.

But when it comes to downloading via the composer commands, it's till asking for username and password.

Is there anything else that we need to disable in order for this to work?

I've also tried to enable user and password, but still doesn't work.

Thanks!

[Rarst]

What precisely do you mean by "disabling the auth" here? Belt's authentication is opt-in, it only works if you enable it by adding users in the config.

I would check if you have some form of authentication on your server/hosting level.

[andreibsl]

By disabling the auth I meant not enabling it 😅
One problem that we also have is that we do want to password protect the repository, but even if we add the user and password, the Auth is not working.

Here is the link to the repo:
https://composer.simplylearn.com/

user: composer
pass: foo
hash: $2y$10$msun65gWqiqrrPksQNQNDephbP.rhwnq1QVcIdOAkE1nui7ItSaMO

Obviously, I'll change the credentials after we solve the issue 😅

[Rarst]

If you put a static file in the site root and try to open it in browser it do you get the authentication prompt? If so - it's not coming from the Belt.

[andreibsl]

Yep, I can access them:
https://composer.simplylearn.com/favicon.ico
https://composer.simplylearn.com/test.html

[Rarst]

What's your Belt config in entirety?

[andreibsl]

Here it is

<?php

declare(strict_types=1);

return [
    // Enable to put the application into the debug mode with extended error messages.
    // 'debug'                 => false,

    // Customize path to the directory containing release ZIP files.
    // 'release.dir'           => __DIR__.'/../releases',

    'users'                    => [
          // User login.
        'composer' => [
              // Provide password hash for HTTP authentication. See bin/encodePassword.php helper.
            'hash'     => '$2y$10$msun65gWqiqrrPksQNQNDephbP.rhwnq1QVcIdOAkE1nui7ItSaMO', // foo
        ],
    ],
];

[Rarst]

I'll try to reproduce later (I don't have my normal setup at the moment), but that looks ok. Can't remember if there are any issues if you don't actually allow/disallow anything for the user.

Also note that browsers can remember HTTP authentication requests very aggressively, so a relaunch/reboot doesn't hurt in between making changes to this stuff.