This may be a really dumb question but I had to make sure that i'm fine with this.
I setup an HTTPS server with basic auth, but the browser informs me that the connection is not secured when i connect to the auth page, and tells me that the connection is secured after i sign in. I want to know whether this is safe, and if not, how can i make it secured?
Config(NGINX):
server {
listen 80;
server_name sub.example.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name sub.example.com;
ssl_ceerificate (certpath);
ssl_certificate_key (certkeypath);
ssl_trusted_certificate (anotherpath);
ssl_dhparam (dhparam);
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA25$
ssl_ecdh_curve secp384r1;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block"
location / {
auth_basic 'Nothing to see here';
proxy_pass http://localhost:4000/;
}
}
Screenshot
