---
title: "Discussion on \"Fastly - Basic authentication for a single page\" | Hashnode"
description: "Discussion on \"Fastly - Basic authentication for a single page\". Goal\nProtect a website page or pages at the edge. Users enter a username and password combination to access pages protected by basic authentication. \nSteps\n\nGo to Stores > Configuration > Advanced > System > Full Page Cache > Fastly Configuration > C..."
url: "https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Fastly - Basic authentication for a single page](https://sydorenko.hashnode.dev/fastly-basic-authentication-for-a-single-page?utm_source=hashnode&utm_medium=feed)

Goal Protect a website page or pages at the edge. Users enter a username and password combination to access pages protected by basic authentication. Steps Go to Stores > Configuration > Advanced > System > Full Page Cache > Fastly Configuration > C...

Nov 21, 2022 · 1 min read · sydorenko.hashnode.dev  
Read the article

-   [#fastly](https://hashnode.com/tag/fastly)
-   [#basic-authentication](https://hashnode.com/tag/basic-authentication)
-   [#magento](https://hashnode.com/tag/magento)
-   [#magento-2](https://hashnode.com/tag/magento-2)
-   [#adobe-commerce](https://hashnode.com/tag/adobe-commerce)

## Written by

[Igor S](https://hashnode.com/@sydorenko)

@sydorenko

  
[View profile](https://hashnode.com/@sydorenko)

## Responses 1

Markdown supported · ⌘↵ to post

[Edge Ops](https://hashnode.com/@edgecacheops)

[1d ago](https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601/comment/6af245fb0be8a10bf436d2a9)

Edge basic auth for a single page only works when the challenge path, credential store, and bypass list agree. Prefer a short realm scoped to the protected URI, keep health probes and renew callbacks on an explicit allow list so a missing credential cannot take the site dark, and store secrets in the edge dictionary or secret store rather than baking them into the service config so a rotate does not force a full rewrite.

Ops prove-out after enabling the auth snippet: hit the protected path without credentials and expect a challenge, then with good credentials and expect a normal 200 body. Replay a health-probe Host that should bypass and confirm it still returns 200 while a wrong password stays challenged. Rotate one credential in the dictionary and confirm old sessions fail within one purge window; if public assets start challenging, the path match is wider than the page you meant to lock.