# HTTP security
**URL:** https://discuss.elastic.co/t/http-security/3682
**Category:** Elasticsearch
**Created:** [December 20, 2010, 10:11pm UTC](https://discuss.elastic.co/t/http-security/3682 "2010-12-20T22:11:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@skaffman\_2](https://discuss.elastic.co/u/skaffman_2)
#### Post date: [December 20, 2010, 10:11pm UTC](https://discuss.elastic.co/t/http-security/3682/1 "2010-12-20T22:11:36Z")
A browse through the ElasticSearch docs is telling me that there is no
support for HTTP authentication. Is this the case?
If so, what would be involved in adding it as a custom module? I
would need different authentication details for different functions
(e.g. no auth for performing searches, but HTTP password required for
delete/put operations).
I would love to use ElasticSearch to replace our existing JSON web
services, but authentication is a critical feature for us.
I suppose we could stick a webserver between clients and
ElasticSearch, but it seems a shame to have to do that.
---
### Author:  [@kimchy](https://discuss.elastic.co/u/kimchy)
#### Post date: [December 21, 2010, 5:50am UTC](https://discuss.elastic.co/t/http-security/3682/2 "2010-12-21T05:50:10Z")
Currently, there are no plan to support authentication and authorization on
ES level (as there are many different ways to do it, and different
levels/operations to support). You would need to do it on a proxy server.
On Tue, Dec 21, 2010 at 12:11 AM, skaffman [kenny@chasmcity.com](mailto:kenny@chasmcity.com) wrote:
> A browse through the Elasticsearch docs is telling me that there is no
> support for HTTP authentication. Is this the case?
>
> If so, what would be involved in adding it as a custom module? I
> would need different authentication details for different functions
> (e.g. no auth for performing searches, but HTTP password required for
> delete/put operations).
>
> I would love to use Elasticsearch to replace our existing JSON web
> services, but authentication is a critical feature for us.
>
> I suppose we could stick a webserver between clients and
> Elasticsearch, but it seems a shame to have to do that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:15am UTC](https://discuss.elastic.co/t/http-security/3682/3 "2017-07-06T04:15:04Z")