title: Bypass http authentication by using a reverse proxy
body: <p>We are running a legacy web application which uses HTTP Authentication. I want to make this application available to some users but I do not want to expose the username/password and I don't want to expose the server the application is running on.</p>
  
  <p>To solve this problem I intend to use mod_proxy. I made the following configuration:</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
      # SSL stuff goes in here
      ServerName "proxy.local"
      ProxyRequests Off
      &lt;Proxy *&gt;
          Order deny,allow
          Allow from all
      &lt;/Proxy&gt;
      ProxyPass / http://admin:password@legacy.local:80/
      ProxyPassReverse / http://admin:password@legacy.local:80/
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>This works, except for the part where users are still asked to type admin/password themselves.
  Can I make Apache send the username/password provided in ProxyPassReserve and not ask the user for it? I could not find the answer in the <a href="http://httpd.apache.org/docs/2.0/mod/mod_proxy.html" rel="nofollow" title="Apache Module mod_proxy">Apache mod_proxy documentation</a>.</p>