When configuring password protection under the Authentication Methods section in Pangolin, the security layer is not being enforced.
After assigning a password to protect a resource, the application does not prompt for authentication and allows access without requiring the configured credentials.
Environment
OS Type & Version: (e.g., Ubuntu 22.04)
Pangolin Version: 1.15.4
Gerbil Version: 1.3.0
Traefik Version: 3.6.8
Newt Version: 1.9.0
Olm Version: (if applicable)
To Reproduce
Navigate to Authentication Methods.
Assign password protection to a resource.
Attempt to access the protected resource.
Observe that no authentication is required
Expected Behavior
Once password protection is enabled and configured, users should be required to authenticate before gaining access to the protected resource.
Originally created by @jtechbyte on GitHub (Feb 16, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2488
### Describe the Bug
When configuring password protection under the Authentication Methods section in Pangolin, the security layer is not being enforced.
After assigning a password to protect a resource, the application does not prompt for authentication and allows access without requiring the configured credentials.
### Environment
- OS Type & Version: (e.g., Ubuntu 22.04)
- Pangolin Version: 1.15.4
- Gerbil Version: 1.3.0
- Traefik Version: 3.6.8
- Newt Version: 1.9.0
- Olm Version: (if applicable)
### To Reproduce
1. Navigate to Authentication Methods.
2. Assign password protection to a resource.
3. Attempt to access the protected resource.
4. Observe that no authentication is required
### Expected Behavior
Once password protection is enabled and configured, users should be required to authenticate before gaining access to the protected resource.
You likely already have a session. Try clearing the cookies or using incognito. I am unable to reproduce.
<!-- gh-comment-id:3961742504 -->
@miloschwartz commented on GitHub (Feb 25, 2026):
You likely already have a session. Try clearing the cookies or using incognito. I am unable to reproduce.
<!-- gh-comment-id:3961933068 -->
@jtechbyte commented on GitHub (Feb 25, 2026):
Yeah I tried external browsers and I still get the login screen without the
extra layer of protection.
On Wed, Feb 25, 2026 at 3:09 PM Milo Schwartz ***@***.***>
wrote:
> Closed #2488 <https://github.com/fosrl/pangolin/issues/2488> as completed.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/fosrl/pangolin/issues/2488#event-23080440144>, or
> unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAR74TAWLR5YR2DCOHTLEJ34NX6QDAVCNFSM6AAAAACVJSF3QKVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMRTGA4DANBUGAYTINA>
> .
> You are receiving this because you authored the thread.Message ID:
> ***@***.***>
>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @jtechbyte on GitHub (Feb 16, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2488
Describe the Bug
When configuring password protection under the Authentication Methods section in Pangolin, the security layer is not being enforced.
After assigning a password to protect a resource, the application does not prompt for authentication and allows access without requiring the configured credentials.
Environment
To Reproduce
Expected Behavior
Once password protection is enabled and configured, users should be required to authenticate before gaining access to the protected resource.
@miloschwartz commented on GitHub (Feb 25, 2026):
You likely already have a session. Try clearing the cookies or using incognito. I am unable to reproduce.
@jtechbyte commented on GitHub (Feb 25, 2026):
Yeah I tried external browsers and I still get the login screen without the
extra layer of protection.
On Wed, Feb 25, 2026 at 3:09 PM Milo Schwartz @.***>
wrote: