Disable http basic auth

[Daniel Huluka]

We run Confluence 6.15.1 - Standalone distribution and enabled two-factor authentication. But it still allows http basic auth. How can I disable that?

Regards,

[Alex K]

Hi Daniel,

Thanks so much for your question.

Currently there is no officially supported method to disable basic authentication in Confluence. We recently introduced personal access tokens to Confluence 7.9 and have plans to allow basic auth to be disabled in the future. 

Thank you,
Alex K (Developer at Atlassian)

Confluence Data Center team

[Hannes Medwed]

Hi Alex.

Can you please explain "have plans" in more detail.
Since our last PEN-Test our security team is paining us with the question when?

Best regards
Hannes

[WW]

Is there an update on this?  I see the article Disabling basic authentication, but that is only for Jira and Bitbucket.

In which future version will the feature to disable basic auth in Confluence Server be released?  Or will it only be in Data Center?

I see in the Preparing for Confluence 7.13 that this is "In Progress" with a link to the article I mentioned above.

We plan to provide admins the ability to disable basic authentication, and will be recommending any integrations use personal access tokens instead. Learn more about disabling basic authentication. This change won't be in 7.13, but you can start testing now by manually upgrading the SSO for Atlassian Server and Data Center to 4.2.0.