# Allow/deny for a single location, with other location handler

**URL:** <https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894>\
**Category:** NGINX\
**Created:** [February 2, 2008, 7:38am UTC](https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894 "2008-02-02T07:38:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rjberry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/34f0e0/32.png) [@rjberry](https://www.ruby-forum.com/u/rjberry)\
**Post date:** [February 2, 2008, 7:38am UTC](https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894/1 "2008-02-02T07:38:12Z")

</div>

Hi,

I’m using nginx to proxy through to apache, with a simple

```
 location / {
     proxy_pass ...
 }

```

However, there is one location ( /account/sync\_profile/) which I’d like  
to restrict to just one IP address.

If I add a location for that address,  
location /account/sync\_profile/ {  
allow 59.150.40.29;  
deny all;  
}

then of course it doesn’t get handled by the proxy.

I can’t put an  
if ($uri = /account/sync\_profile) { allow 59.150.40.29; deny all; }  
inside my main location, since allow, deny won’t work there.

I can’t use a multi-level if;

I suppose one solution would be to include the proxy config into the  
restricted location as well, but this seems like unnecessarily verbose…

Any ideas?

thanks,  
robert.

---

<div class="post-metadata">

**Author:** ![rjberry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/34f0e0/32.png) [@rjberry](https://www.ruby-forum.com/u/rjberry)\
**Post date:** [February 2, 2008, 6:33pm UTC](https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894/2 "2008-02-02T18:33:51Z")

</div>

Robert B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Any ideas?

location /account/sync\_profile/ {  
allow 59.150.40.29;  
deny all;  
proxy\_pass …  
}

location / {  
proxy\_pass …  
}

---

<div class="post-metadata">

**Author:** ![rjberry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/34f0e0/32.png) [@rjberry](https://www.ruby-forum.com/u/rjberry)\
**Post date:** [February 3, 2008, 2:25am UTC](https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894/3 "2008-02-03T02:25:37Z")

</div>

proxy\_\* config declarations in the server block trickle down to  
location blocks.

eg:

proxy\_set\_header X-Forwarded-For $http\_x\_client\_ip;  
…  
location / { proxy\_pass …; } # (1)  
location /account/sync\_profile/ { allow 59.150.40.29; deny all;  
proxy\_pass …; } # (2)

both (1) and (2) will pass along the X-Client-IP header

---

<div class="post-metadata">

**Author:** ![rjberry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/34f0e0/32.png) [@rjberry](https://www.ruby-forum.com/u/rjberry)\
**Post date:** [February 3, 2008, 3:58am UTC](https://www.ruby-forum.com/t/allow-deny-for-a-single-location-with-other-location-handler/127894/4 "2008-02-03T03:58:52Z")

</div>

Thanks Eden, I guess that way will allow me to put the minimum amount of  
config in each location directive, at least.

So for the record, I ended up with:

server {  
…  
proxy\_buffers …;  
proxy\_set\_header…;  
… other global proxy options;  
location / {  
proxy\_pass [http://bella](http://bella);  
}  
location /special\_url/ {  
allow 59.150.40.29;  
deny all;  
proxy\_pass [http://bella](http://bella);  
}  
location /static/ {  
…  
}  
}

Not so bad, as long as I don’t have too many of these special  
per-location rules.

thanks,  
robert.