Even though the password has been set, accessing still does not require a password.

[liuliran123]

In addition, the documentation does not mention any enabled password authentication feature. How can we guarantee security?

TRANS_BY_GPT3

[liuliran123]

There is also no password authentication feature enabled in the document. How can security be ensured?

TRANS_BY_GPT3

[Kentsonshum]

Have you read the http.api.auth.conf document carefully? The format is incorrect. You also need to enable auth under the api section.

http_api {
    enabled         on;
    listen          1985;
    auth {
        enabled         on;
        username        admin;
        password        admin;
    }
}

TRANS_BY_GPT3

[winlinvip]

Doc is here https://ossrs.io/lts/en-us/docs/v5/doc/http-api#authentication

Thanks @Kentsonshum