# OH3 Apache Reverse-proxy Authentication Fails Unauthorized access

**URL:** <https://community.openhab.org/t/oh3-apache-reverse-proxy-authentication-fails-unauthorized-access/120578>\
**Category:** Installation\
**Created:** [April 10, 2021, 2:15pm UTC](https://community.openhab.org/t/oh3-apache-reverse-proxy-authentication-fails-unauthorized-access/120578 "2021-04-10T14:15:42Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![fifo](https://community.openhab.org/letter_avatar_proxy/v4/letter/f/e19adc/32.png) [@fifo](https://community.openhab.org/u/fifo)\
**Post date:** [July 3, 2021, 1:01pm UTC](https://community.openhab.org/t/oh3-apache-reverse-proxy-authentication-fails-unauthorized-access/120578/15 "2021-07-03T13:01:47Z")

</div>

> [@Alahdal](#):
>
> `Header add Set-Cookie "X-OPENHAB-AUTH-HEADER=true;path=/;Secure"`

@Alahdal Thank you for the help here! I can confirm that the fix in my case was exactly what you mentioned and @JustinG confirmed.

```auto
RequestHeader set Authorization ""

```

needs to be replaced with ( Note you no longer need the " " at the end)

```auto
RequestHeader unset Authorization

```

My current working config is as follows.

```yaml
<VirtualHost *:444>
        ServerName xyz.example.com
        SSLEngine on

        Include /etc/letsencrypt/options-ssl-apache.conf
        SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

        ProxyPreserveHost on
        ProxyPass / http://10.0.0.1:8080/
        ProxyPassReverse / http://10.0.0.1:8080/

        Header set Set-Cookie "X-OPENHAB-AUTH-HEADER=1"
        RequestHeader set X-Forwarded-Proto "https" env=HTTPS
        RequestHeader unset Authorization

        <Location />
                AuthType Basic
                AuthName "xyz.example.com 444 "
                AuthUserFile /etc/apache2/.passwd
                Require valid-user
                Allow from 10.0.0.0/255.255.255.0
        </Location>
</VirtualHost>

```

The following line doesn’t seem to make any difference but I left it in just in case it impacts something I am not seeing.

```yaml
Header set Set-Cookie "X-OPENHAB-AUTH-HEADER=1"

```

I will post this in github and close out the bug report…

---

_[View the full topic](https://community.openhab.org/t/oh3-apache-reverse-proxy-authentication-fails-unauthorized-access/120578)._