From 32ff79027728f7c8e521f4d94bbe0f46d5465d0e Mon Sep 17 00:00:00 2001
From: Kimmo Puputti <git@kimmo.kpuputti.fi>
Date: Fri, 6 Oct 2017 09:55:03 +0300
Subject: [PATCH] Skip basic auth for static resources

---
 server/index.js | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/server/index.js b/server/index.js
index 2f300973..8e330060 100644
--- a/server/index.js
+++ b/server/index.js
@@ -77,17 +77,19 @@ if (TRUST_PROXY === 'true') {
   app.set('trust proxy', TRUST_PROXY);
 }
 
-// Use basic authentication when not in dev mode.
+app.use(compression());
+app.use('/static', express.static(path.join(buildPath, 'static')));
+app.use(cookieParser());
+
+// Use basic authentication when not in dev mode. This is
+// intentionally after the static middleware to skip basic auth for
+// static resources.
 if (!dev) {
   const USERNAME = process.env.BASIC_AUTH_USERNAME;
   const PASSWORD = process.env.BASIC_AUTH_PASSWORD;
   app.use(auth.basicAuth(USERNAME, PASSWORD));
 }
 
-app.use(compression());
-app.use('/static', express.static(path.join(buildPath, 'static')));
-app.use(cookieParser());
-
 const noCacheHeaders = {
   'Cache-control': 'no-cache, no-store, must-revalidate',
 };