Post via admin-ajax.php causes auth pop-up

[diesocke]

The website I run uses basic authentication for the /wp-admin/ folder. As Statify uses admin-ajax.php to post the view of the site, this causes the basic authentication to pop up. Is there a way to avoid this without shutting down protection for wp-admin?

I have deactivated Statify to stop the login popup, but I actually want to use the service.

[MatzeKitt]

I think, the easiest way would be not using basic authentication for admin-ajax.php. By using the internal Ajax mechanics, you need to use the file /wp-admin/admin-ajax.php.

An example on how to disable basic authentication in Apache2:

AuthUserFile /path/to/.htpasswd
AuthName "Authorization Required"
AuthType Basic
require valid-user
<Files "/wp-admin/admin-ajax.php">
    Satisfy Any
    Allow from all
</Files>

[diesocke]

I guess this is connected with this update:

| JavaScript-Tracking überarbeitet unter Verwendung von WP AJAX (#109) (#142)

[stklcode]

Exactly.

If an additional authentication is configured for the AJAX endpoint, there is no way Statify can get around this (otherwise the auth mechanism would obviously be useless).
There are several other plugins that use AJAX for frontend applications, all facing the same issue as for some reason the additional auth layer has been recommended in several “security“ guides over time (there certainly are better ways imho, but that’s another story).

We should probably add this to the FAQ as at least 3 support requests reached us in the last 3 weeks. The upgrade notice is likely overseen and/or the impact is unclear.

[Zodiac1978]

Another way could be to just protect the file wp-login.php.

[diesocke]

Another way could be to just protect the file wp-login.php.

Would be, but I cannot do that, because there is a password protected area with access only for employees. If I directed the restriction on wp-login.php they would have to know the complex username and password AND the password for the internal page.

[patrickrobrecht]

I've updated your documentation on JavaScript tracking. Now we explicitly state that the Ajax endpoint is mandatory.