Credential is required when accessing https://<ESXi IP>/cgi-bin/xxx

Products

• VMware vSphere ESXi

Issue/Introduction

When a user attempts to access the Host Client via an arbitrary CGI URL (e.g., https://<ESXi IP>/cgi-bin/xxx), the system redirects them to the login page.

Environment

VMware vSphere ESX 8.x
VMware vSphere ESX 7.x

Cause

The standalone CGI server (hostdCgiServer) allows access for all full-admin VIM users. These are users that have Admin role on the root inventory object in the ESXi inventory tree. These are the same users that can log into a shell (SSH or local).
A CGI request is an HTTP request to URL path /cgi-bin on the ESXi host. It is first handled by the reverse HTTP proxy, which redirects it to the CGI server based on the endpoint configuration for the path "/cgi-bin".
The CGI Scripts Executor module is the component of the CGI server that invokes the appropriate CGI script, redirects (streams) the incoming HTTP request to the script and redirects (streams) the output of the CGI script back to the client as the HTTP response. This step follows the authentication and authorization.
If the HTTP request does not contain POST form parameters for username and password, then the server returns a special login page that prompts for user credentials.

Resolution

It is expected behavior.