# Auth\_basic and file uploads

**URL:** <https://www.ruby-forum.com/t/auth-basic-and-file-uploads/228145>\
**Category:** NGINX\
**Created:** [April 11, 2013, 8:18am UTC](https://www.ruby-forum.com/t/auth-basic-and-file-uploads/228145 "2013-04-11T08:18:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![steveybaby](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c57346/32.png) [@steveybaby](https://www.ruby-forum.com/u/steveybaby)\
**Post date:** [April 11, 2013, 8:18am UTC](https://www.ruby-forum.com/t/auth-basic-and-file-uploads/228145/1 "2013-04-11T08:18:52Z")

</div>

Hi Folks,

I’ve got a magento site under development, and just want it to be  
password protected until it goes live. No problem I thought…

add in the auth\_basic/auth\_basic\_user\_file entries to the location /  
block.

However, when I do that, I get a password request for the upload…

2013/04/11 05:12:40 [error] 9866#0: \*31 no user/password was provided  
for basic authentication, client: Mmy IP\>, server: [example.com](http://example.com), request:  
“POST /index.php/admin/catalog\_product\_gallery/upload/key/ HTTP/1.1”, host: “[example.com](http://example.com)”

If I enclose the auth\_basic/auth\_basic\_user\_file entries in a  
limit\_except POST block, then I can’t log in, wcwn though it them works  
perfectly if I’m already logged in!

Any pointers??

Cheers,

Steve

---

<div class="post-metadata">

**Author:** ![steveybaby](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c57346/32.png) [@steveybaby](https://www.ruby-forum.com/u/steveybaby)\
**Post date:** [April 11, 2013, 1:01pm UTC](https://www.ruby-forum.com/t/auth-basic-and-file-uploads/228145/2 "2013-04-11T13:01:01Z")

</div>

Hello!

On Thu, Apr 11, 2013 at 06:18:19PM +1200, Steve H. wrote:

> 2013/04/11 05:12:40 [error] 9866#0: \*31 no user/password was provided  
> Any pointers??  
> If your browser sees password request only on file uploads, it may  
> not be able to get 401 (Unauthorized) response correctly and retry  
> the request with authentication. I would expect this to be very  
> similar to 413 (Request Entity Too Large) handling by browsers, as  
> explicitly mentioned here in docs:

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)**
>
> This directive appeared in version 1.11.8.

Obvious solution is to require authentication before the upload.

–  
Maxim D.

> **[nginx: donation](http://nginx.org/en/donation.html)**