I have a Netlify function that will work like a cronjob. I will trigger it through GitHub Actions. At the moment anyone who knows the url can trigger the cronjob. The url can in theory be spammed by a bot, so I want to add basic authentication on this url. I found that following setup must work, but it doesn't. After deploy the url is still publicly available and no authentication is required.
I created a _headers file:
/.netlify/functions/function1
Basic-Auth: username:password
#netlify.toml
[build]
command = “yarn build && cp _headers public/_headers”
functions = “functions”
publish = “public”
During deploying I can see it’s picking this up:
2:38:08 PM: ┌────────────────────────────────────┐
2:38:08 PM: │ 2. build.command from netlify.toml │
2:38:08 PM: └────────────────────────────────────┘
2:38:08 PM: $ yarn build && cp _headers public/_headers
After the deploy has finished and I download the deploy, I can see the _headers file. It’s equal to my local (dev) file.
However, with all this, when surfing to “app.netlify.app/.netlify/functions/function1” the page does not request a username and password and the page behaves like no authentication is present.
I followed examples like:
- https://docs.netlify.com/visitor-access/password-protection/#site-wide-protection
- https://goulet.dev/posts/how-to-password-protect-staging-on-netlify/
Does anyone know what might be missing in my setup?
Thanks