Password protection

Password protection puts a password page in front of a hostname of your storefront. The check runs at Cloudflare's edge, before the request reaches your storefront or its cache. The limits page lists its numbers.

What it protects

• Previews are protected by default: every deployment's own address (<name>-<9 characters>.laioutr.app) and the addresses of environments other than production.
• Production's own hostname and your domains are protected when you switch them on, one by one.
• An apex hostname (example.com without www) is never protected. It redirects to www; protect that hostname.

When you protect one hostname of a storefront while another hostname serves the same storefront publicly, Cockpit names the public one, so the content is not reachable unprotected by accident.

Setting the password

Open Hosting › Laioutr Cloud in Cockpit and go to Password protection. Project Managers and Owners can set it.

A project has one password. A new password replaces the old one and logs out everyone who used the old one. A visitor who entered the password stays logged in for 7 days.

Bypass secrets for automation

A bypass secret lets a machine through without the password page: a CI smoke test, an end-to-end test suite, a monitoring check. Create one per machine in the same panel, so you can revoke one without the others.

• Send the secret in the header x-laioutr-protection-bypass: <secret>.
• When you cannot set a header, send it as the query parameter ?x-laioutr-protection-bypass=<secret>.
• To get a cookie instead, add x-laioutr-set-bypass-cookie=true to a GET request with the secret. The answer sets the cookie and redirects to the same URL without the parameters. Inside a cross-site frame, use x-laioutr-set-bypass-cookie=samesitenone.

A wrong secret is treated like none: the visitor sees the password page. The secret never reaches your storefront. A revoked secret stops working within 60 seconds.

Laioutr Studio

Laioutr Studio has its own bypass secret, which Cockpit creates for you. It lets Studio show your protected previews. It cannot be revoked; if it leaks, rotate it in the panel.

Examples

A CI smoke test against a deployment's own address:

curl -fsS -H 'x-laioutr-protection-bypass: prbp_…' https://<name>-<9 characters>.laioutr.app/

A Playwright suite that sends the secret with every request:

import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    baseURL: process.env.PREVIEW_URL,
    extraHTTPHeaders: { 'x-laioutr-protection-bypass': process.env.LAIOUTR_PROTECTION_BYPASS! },
  },
});