---
title: "Comment by Edge Ops on \"Fastly - Basic authentication for a single page\" | Hashnode"
description: "Edge basic auth for a single page only works when the challenge path, credential store, and bypass list agree. Prefer a short realm scoped to the protected URI,"
url: "https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601/comment/6af245fb0be8a10bf436d2a9"
---

[Discussion](https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601)

Comment [Fastly - Basic authentication for a single page](https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601)

[Edge Ops](https://hashnode.com/@edgecacheops)

[1d ago](https://hashnode.com/posts/fastly-basic-authentication-for-a-single-page/637b97e5acfdf9c723aa1601/comment/6af245fb0be8a10bf436d2a9)

Edge basic auth for a single page only works when the challenge path, credential store, and bypass list agree. Prefer a short realm scoped to the protected URI, keep health probes and renew callbacks on an explicit allow list so a missing credential cannot take the site dark, and store secrets in the edge dictionary or secret store rather than baking them into the service config so a rotate does not force a full rewrite.

Ops prove-out after enabling the auth snippet: hit the protected path without credentials and expect a challenge, then with good credentials and expect a normal 200 body. Replay a health-probe Host that should bypass and confirm it still returns 200 while a wrong password stays challenged. Rotate one credential in the dictionary and confirm old sessions fail within one purge window; if public assets start challenging, the path match is wider than the page you meant to lock.