diff --git a/backend/src/middleware/photoAuth.js b/backend/src/middleware/photoAuth.js
new file mode 100644
index 0000000..950d852
--- /dev/null
+++ b/backend/src/middleware/photoAuth.js
@@ -0,0 +1,36 @@
+const bcrypt = require('bcrypt');
+const { db } = require('../database/db');
+
+async function photoAuth(req, res, next) {
+  try {
+    const eventSlug = req.path.split('/')[1];
+    const password = req.headers['x-gallery-password'];
+    
+    if (!password) {
+      return res.status(401).json({ error: 'Password required' });
+    }
+    
+    const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+    if (!event) {
+      return res.status(404).json({ error: 'Gallery not found' });
+    }
+    
+    const validPassword = await bcrypt.compare(password, event.password_hash);
+    if (!validPassword) {
+      await db('access_logs').insert({
+        event_id: event.id,
+        ip_address: req.ip,
+        user_agent: req.headers['user-agent'],
+        action: 'login_fail'
+      });
+      return res.status(401).json({ error: 'Invalid password' });
+    }
+    
+    req.event = event;
+    next();
+  } catch (error) {
+    res.status(500).json({ error: 'Authentication error' });
+  }
+}
+
+module.exports = photoAuth;