github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 08:30:05 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #3203] Allow auth between the Ollama server/client #48487

New Issue
Open
opened 2026-04-28 08:41:03 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-28 08:41:03 -05:00
Owner
Copy Link

Originally created by @ftoppi on GitHub (Mar 17, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/3203

What are you trying to do?

I'm trying to secure the connection between ollama client and server.

HTTPS works fine:
image

Basic auth does not work with ollama client:
image

How should we solve this?

Allow to set basic auth in OLLAMA_HOST or other variables for the client.

What is the impact of not solving this?

The only way to secure the connection between ollama client and ollama server is with IP filtering. Basic auth would be a bit better.
Note that for any other client (such as python requests), this is not an issue since those packages can manage basic auth (or other auth mechanisms for that matter).

Anything else?

Allowing the server to use TLS would be nice too. Traffic is still cleartext between the reverse proxy and ollama server.
Displaying a better error message with http status code would be nice.

Originally created by @ftoppi on GitHub (Mar 17, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/3203 ### What are you trying to do? I'm trying to secure the connection between ollama client and server. HTTPS works fine: ![image](https://github.com/ollama/ollama/assets/4704016/b097b70e-8774-48af-8e6e-053fdb972fc3) Basic auth does not work with ollama client: ![image](https://github.com/ollama/ollama/assets/4704016/58af9422-c92e-43f7-931c-0b3af99b960d) ### How should we solve this? Allow to set basic auth in OLLAMA_HOST or other variables for the client. ### What is the impact of not solving this? The only way to secure the connection between ollama client and ollama server is with IP filtering. Basic auth would be a bit better. Note that for any other client (such as python requests), this is not an issue since those packages can manage basic auth (or other auth mechanisms for that matter). ### Anything else? Allowing the server to use TLS would be nice too. Traffic is still cleartext between the reverse proxy and ollama server. Displaying a better error message with http status code would be nice.
GiteaMirror added the feature request label 2026-04-28 08:41:03 -05:00
GiteaMirror commented 2026-04-28 08:41:08 -05:00
Author
Owner
Copy Link

@neuhaus commented on GitHub (Sep 17, 2024):

I came here to request this feature. Right now the code in /envconfig/config.go will interpret the ":" separating the username from the password as the separator for the tcp port number.

I think the issue title should be changed to:

Add support for HTTP Basic authentication to OLLAMA_HOST environment variable

By the way, another way to solve this would be to add support for Bearer tokens in the Authorization header as done by OpenAI.

<!-- gh-comment-id:2354852272 --> @neuhaus commented on GitHub (Sep 17, 2024): I came here to request this feature. Right now the code in [/envconfig/config.go](../tree/main/envconfig/config.go) will interpret the ":" separating the username from the password as the separator for the tcp port number. I think the issue title should be changed to: **Add support for HTTP Basic authentication to OLLAMA_HOST environment variable** By the way, another way to solve this would be to add support for Bearer tokens in the Authorization header [as done](https://platform.openai.com/docs/api-reference/authentication) by OpenAI.
GiteaMirror commented 2026-04-28 08:41:10 -05:00
Author
Owner
Copy Link

@neuhaus commented on GitHub (Sep 17, 2024):

This is a duplicate of issue #1053 and should be closed.

<!-- gh-comment-id:2354878025 --> @neuhaus commented on GitHub (Sep 17, 2024): This is a duplicate of issue #1053 and should be closed.
GiteaMirror commented 2026-04-28 08:41:18 -05:00
Author
Owner
Copy Link

@gabrielklein commented on GitHub (Jan 5, 2025):

What I did is to have a proxy on my apache configuration with basic authentication.

I have a server at home that is open to the web and another one that is used for data mining (with a graphic card, ollama, etc..)

It works great with my own scripts. Sadly many software that use ollama don't support this approach.

<VirtualHost *:80>

    ServerAdmin me@mysite.ch
    ServerName ollama.mysite.ch       


    ProxyRequests Off

    ProxyPass / http://10.7.2.11:11434/
    ProxyPassReverse / http://10.7.2.11:11434/

    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://10.7.2.11:11434/$1" [P,L]

    <Location />
		AuthType Basic
		AuthName "Restricted Content"
		AuthUserFile /etc/apache2/htpasswd
		Require valid-user
	</Location>

    ErrorLog /var/log/apache2/error-ollama.mysite.ch.log
    LogLevel warn
    CustomLog /var/log/apache2/ollama.mysite.ch combined

Then secure it using certbot (letsencrypt)
certbot -tvv --apache -m moi@mysite.ch --redirect --hsts --uir --reinstall -d ollama.mysite.ch

<!-- gh-comment-id:2571761313 --> @gabrielklein commented on GitHub (Jan 5, 2025): What I did is to have a proxy on my apache configuration with basic authentication. I have a server at home that is open to the web and another one that is used for data mining (with a graphic card, ollama, etc..) It works great with my own scripts. Sadly many software that use ollama don't support this approach. <VirtualHost *:80> ServerAdmin me@mysite.ch ServerName ollama.mysite.ch ProxyRequests Off ProxyPass / http://10.7.2.11:11434/ ProxyPassReverse / http://10.7.2.11:11434/ RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^/?(.*) "ws://10.7.2.11:11434/$1" [P,L] <Location /> AuthType Basic AuthName "Restricted Content" AuthUserFile /etc/apache2/htpasswd Require valid-user </Location> ErrorLog /var/log/apache2/error-ollama.mysite.ch.log LogLevel warn CustomLog /var/log/apache2/ollama.mysite.ch combined </VirtualHost> Then secure it using certbot (letsencrypt) certbot -tvv --apache -m moi@mysite.ch --redirect --hsts --uir --reinstall -d ollama.mysite.ch
GiteaMirror commented 2026-04-28 08:41:20 -05:00
Author
Owner
Copy Link

@LeisureLinux commented on GitHub (Feb 12, 2025):

my understanding is not many popular front-end support ollama basic authentication.

I also use aichat, which can put basic auth URL like this, which is something I hope all the other front-end tools can support as well:

api_base: http://ollama-api:LeisureLinux@ollama.lan:80/v1

and Page-Assist works perfectly as mentioned in the comment:
https://github.com/ollama/ollama/issues/1053#issuecomment-2653885309

<!-- gh-comment-id:2653919007 --> @LeisureLinux commented on GitHub (Feb 12, 2025): my understanding is not many popular front-end support ollama basic authentication. I also use aichat, which can put basic auth URL like this, which is something I hope all the other front-end tools can support as well: `api_base: http://ollama-api:LeisureLinux@ollama.lan:80/v1` and Page-Assist works perfectly as mentioned in the comment: https://github.com/ollama/ollama/issues/1053#issuecomment-2653885309
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label feature request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#48487
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?