diff --git a/server/index.js b/server/index.js
index 2f300973..8e330060 100644
--- a/server/index.js
+++ b/server/index.js
@@ -77,17 +77,19 @@ if (TRUST_PROXY === 'true') {
   app.set('trust proxy', TRUST_PROXY);
 }
 
-// Use basic authentication when not in dev mode.
+app.use(compression());
+app.use('/static', express.static(path.join(buildPath, 'static')));
+app.use(cookieParser());
+
+// Use basic authentication when not in dev mode. This is
+// intentionally after the static middleware to skip basic auth for
+// static resources.
 if (!dev) {
   const USERNAME = process.env.BASIC_AUTH_USERNAME;
   const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
   app.use(auth.basicAuth(USERNAME, PASSWORD));
 }
 
-app.use(compression());
-app.use('/static', express.static(path.join(buildPath, 'static')));
-app.use(cookieParser());
-
 const noCacheHeaders = {
   'Cache-control': 'no-cache, no-store, must-revalidate',
 };