Correctly-verified htpasswd passwords consistently rejected (401) across bcrypt, SHA-256, MD5, and SHA-1 formats on linux/arm64

[Singheskan]

I ran into something pretty strange while setting up rest-server on a Raspberry Pi 4 and wanted to report it since I couldn't find anything matching it in existing issues.

Running rest-server 0.14.0 (compiled with go1.24.3 on linux/arm64) on Raspberry Pi OS. No matter what I did, every single request got rejected with 401 Unauthorized, even though I could prove the password was correct.

I went through this pretty thoroughly because I assumed I was just making a typo somewhere (which, to be fair, did happen once along the way!). But even after ruling that out completely, it kept failing. I tried regenerating the htpasswd file with bcrypt (-B), SHA-256 (-2), and apr1-MD5 (-m) — all three gave a 401 and the debug log showed Invalid htpasswd entry for my user. So I figured maybe those formats weren't actually supported despite the docs mentioning them.

Then I noticed a comment in your own htpasswd.go saying entries need to be created with -s (SHA-1), so I tried that instead. This time the debug log didn't complain about the entry at all — no more "invalid entry" message — but it still returned 401 on every request.

At that point I wanted to be really sure it wasn't me, so I checked it two independent ways:

htpasswd -v on the file said the password was correct
I manually hashed the password myself with openssl dgst -sha1 -binary | base64 and compared it directly against what was stored in the file — it matched exactly, byte for byte

So the password was provably right, the file parsed cleanly, and it was still getting rejected. I also ruled out the network/tunnel as a factor by testing locally on the same machine rest-server was running on — same result.

In the end I gave up and switched to --no-auth.

[MichaelEischer]

Please provide the exact steps you've followed for creating the htpasswd file, running rest-server and also for running restic. Preferably use some placeholder values for the username and password and include the full commands.

[tekeous]

I am having the same issue running restic-rest-server as a Docker container on Unraid. Linked Unraid forum post. For all intents and purposes the server is accessible at http://restic.server:8000 and works with --no-auth.

Ultimately, I can run create_user user password inside the docker container and the .htpassword file correctly reflects user:$2y$05$G.F1JinrhGvp/yeVxhL5quU/pl5K3.s/72.iTEZlw57U2km8QBlgS, but the result of restic init is Fatal: Fatal: create repository at rest:http://restic.server:8000/user/ failed: unexpected HTTP response (401): 401 Unauthorized. Restarting the Docker container doesn't fix the issue.

I am using the following environment variables on the end user machine(placeholders swapped) and running restic init

RESTIC_PASSWORD password
RESTIC_REPOSITORY rest:http://restic.server:8000/user/
RESTIC_REPOSITORY_PASSWORD password
RESTIC_USERNAME user

[MichaelEischer]

@tekeous you're environment variables are wrong. Neither RESTIC_USERNAME nor RESTIC_REPOSITORY_PASSWORD exist.

The correct ones for the REST backend are RESTIC_REST_USERNAME and RESTIC_REST_PASSWORD .

[tekeous]

@MichaelEischer My apologies, I typed that by hand, and it's not the first time those variables have thrown me off and I'm sure it won't be the last. Here's a sanitized output from my machine:

nico@titus ~> env
RESTIC_REST_USERNAME=titus
RESTIC_REPOSITORY=rest:http://192.168.100.1:8001/titus/
PWD=/home/nico
RESTIC_REST_PASSWORD=<removed>
XDG_RUNTIME_DIR=/run/user/1000
XDG_SESSION_ID=68354
MOTD_SHOWN=pam
RESTIC_PASSWORD=<removed>
LANG=en_US.utf8
SHLVL=1
SSH_CONNECTION=192.168.100.12 52991 192.168.66.10 22
LOGNAME=nico
SSH_CLIENT=192.168.100.12 52991 22
XDG_SESSION_CLASS=user
PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
USER=nico
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
XDG_SESSION_TYPE=tty
HOME=/home/nico
SSH_TTY=/dev/pts/3
TERM=xterm-256color
SHELL=/usr/bin/fish

However, now it's working, and I left authentication disabled...so I'll keep working on this.

[MichaelEischer]

Then append --log - (logs to stdout) or --log file.log to the rest-server command line. Are there log entries if you try to access it using restic? What does curl -v http://<rest-server-url> return?

Edit:
Also start restic with DEBUG_LOG=debug.log restic .... This will write a lot of debug output to the specified logfile. Is there maybe anything useful in it?

using the password hash you posted above, I can successfully talk to rest-server. That is the password hash is not the problem.