<p>Is ingress-nginx's external-auth secure when using an external service like httpbin? The example connects to <a href="https://httpbin.org/basic-auth/user/passwd" rel="nofollow noreferrer">https://httpbin.org/basic-auth/user/passwd</a> with the user and password inside of the URL. </p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: https://httpbin.org/basic-auth/user/passwd
</code></pre>

<p>It seems to work fine when I try it myself. (read: when inspecting with curl, I cannot see this url) but maybe I'm missing something. </p>

<p>Is this secure for a production environment?</p>

<p>Reference: <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/external-auth/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/auth/external-auth/</a></p>

Nick
<p>General.<br>
It is never ok to put username and password in GET URL in any environment. It should be post and that to encrypted.  </p>

<p>To your problem. <br>
Basic auth is just as FYI.. Use oauth which is pretty common. </p>

<p><a href="https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/</a> </p>
