Why Squid Basic Authentication Still Accepts an Old Password

Changing Squid's password file does not necessarily make every subsequent request call the helper again. For Basic authentication, Squid can cache a successfully validated username-and-password pair.

The Squid 6.13 setting controlling that assumption is credentialsttl. For example:

auth_param basic credentialsttl 5 minutes

This is an example policy value, not a universal recommendation. Choose it according to the revocation delay you can accept and the load your authentication backend can handle.

Separate three checks

First confirm that you edited the file used by the active helper. A correct change to an unused file has no effect. Next check that the helper can read the file and validate the new account information. Finally, test a fresh proxy request through the running instance, where credential caching and access rules also apply.

Test the helper and the running proxy separately. The helper shows current backend acceptance, while Squid may still reuse a cached validation. During rotation, check both that the new credential works and that the old one is rejected after the applicable validation window.

Use a dedicated test account when investigating this behavior. Keep the request, client source, and target consistent, and avoid putting real passwords into shared command output.

Plan revocation rather than relying on a file edit

A shorter validation lifetime increases backend work. Before reducing it across a busy service, consider helper capacity and verify the behavior with the actual backend. Do not assume a configuration reload flushes every relevant authentication state unless that has been established for your version and setup.

For urgent access removal, an explicit account or source access denial can provide a separate boundary. Test that denial from the affected route instead of relying only on removal from a password file.

This setting describes Basic validation caching. Connection-oriented authentication schemes have additional state and should not be assigned the same revocation model by analogy.