airbyte 0.42, basic auth username and password is not working, could login to the UI direcly without any credentials

Airbyte has introduced Basic Auth to its Open Source version, which allows you to set a username and password for accessing the UI. These credentials are set in the

.env

file of your environment. Here is an example of how to set these values:

BASIC_AUTH_USERNAME=your_new_username_here   BASIC_AUTH_PASSWORD=your_new_password_here

(Source: [Operating-airbyte > Security > Securing Airbyte Open Source > Network Security](https://docs.airbyte.com/operating-airbyte/security#network-security)) If you're able to access the UI without entering any credentials, it's possible that the Basic Auth is not properly set up. Make sure that the

BASIC_AUTH_USERNAME

and

BASIC_AUTH_PASSWORD

are correctly set in your

.env

file and not set to empty values, which would disable the Basic Auth. If you're still facing issues, it might be a good idea to check your security group settings or how you're trying to connect to the UI. For instance, if you're deploying on AWS EC2, the recommended method is using an SSH tunnel ([source](https://discuss.airbyte.io/t/1314)). If the issue persists, consider reaching out to the Airbyte community on their [discussion forum](https://discuss.airbyte.io/) for further assistance.

@kapa.ai they are not set to empty values, still we are not asked for username and pwd for the UI, we are on GCP

Airbyte's UI does not inherently support login/logout options or password protection. However, if you're using Google Cloud Platform, you can use Identity-Aware Proxy (IAP) to deploy Airbyte and allow restricted access. This way, you can control who has access to your Airbyte instance. For more details on how to set up IAP, you can refer to the [Google Cloud IAP documentation](https://cloud.google.com/iap). There is also a [Github issue](https://github.com/airbytehq/airbyte/issues/6323) requesting a tutorial to improve Airbyte's documentation on this topic. For API authentication, Airbyte uses a secure method where the credentials (e.g., username and password) are not specified as part of the connector, but are part of the configuration specified by the end user when setting up a source based on the connector. These credentials are stored securely in your Airbyte instance. If your API doesn't require authentication, you can set it to "No auth". This means the connector will be able to make requests to the API without providing any credentials. Sources: - [Airbyte Authentication](https://docs.airbyte.com/connector-development/connector-builder-ui/authentication) - [Forum Post: Secure UI login?](https://discuss.airbyte.io/t/938) - [Forum Post: Does Airbyte support RBAC or permissioning in the UI?](https://discuss.airbyte.io/t/97)