# Auth\_basic not requiring Authorization

**URL:** <https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982>\
**Category:** NGINX\
**Created:** [July 1, 2011, 5:58pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982 "2011-07-01T17:58:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [July 1, 2011, 5:58pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982/1 "2011-07-01T17:58:38Z")

</div>

Having a huge problem with the auth\_basic. Despite putting in the exact  
same lines as what I found in many examples, the web server is still  
allowing access even without sending any authorization.  
Relevent conf bits:

server {  
listen 80;  
server\_name [my.servers.name.com](http://my.servers.name.com);  
log\_format fullCombined '$remote\_addr - $http\_x\_forwarded\_for  
$remote\_user [$time\_local] ’  
'“$request” $http\_content\_length $status  
$body\_bytes\_sent ’  
‘“$http\_referer” “$http\_user\_agent”’;  
access\_log /var/log/nginx/access.log fullCombined;  
error\_log /var/log/nginx/error.log;

```
root /var/www/current/pub;

client_body_buffer_size 1024k;

```

## Default location

```
location / {
    index index.php;

    auth_basic "Ingester";
    auth_basic_user_file .htpasswd;

    rewrite ^index.php(.*)$ /index.php?/$1 last;
    if (!-f $request_filename) {
            rewrite ^/(.*)$ /index.php?/$1 last;
            break;
    }

}

```

## Parse all .php file in the /var/www directory

```
location ~ .php$ {
    fastcgi_pass backend;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME

```

$document\_root$fastcgi\_script\_name;  
include /etc/nginx/fastcgi\_params;  
fastcgi\_param QUERY\_STRING $query\_string;  
fastcgi\_param REQUEST\_METHOD $request\_method;  
fastcgi\_param CONTENT\_TYPE $content\_type;  
fastcgi\_param CONTENT\_LENGTH $content\_length;  
fastcgi\_intercept\_errors on;  
fastcgi\_ignore\_client\_abort off;  
fastcgi\_connect\_timeout 60;  
fastcgi\_send\_timeout 180;  
fastcgi\_read\_timeout 180;  
fastcgi\_buffer\_size 128k;  
fastcgi\_buffers 4 256k;  
fastcgi\_busy\_buffers\_size 256k;  
fastcgi\_temp\_file\_write\_size 256k;  
}

## Disable viewing .htaccess & .htpassword

```
location ~ /\.ht {
    deny all;
}

```

}

Thanks in advance,  
Brian

Posted at Nginx Forum:

> **[auth\_basic not requiring Authorization](https://forum.nginx.org/read.php?2,211601,211601#msg-211601)**
>
> Having a huge problem with the auth\_basic. Despite putting in the exact same lines as what I found in many examples, the web server is still allowing access even without sending any authorization. Relevent conf bits: server { listen 80; server\_name...

---

<div class="post-metadata">

**Author:** ![bindsocket](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/898d66/32.png) [@bindsocket](https://www.ruby-forum.com/u/bindsocket)\
**Post date:** [July 1, 2011, 6:18pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982/2 "2011-07-01T18:18:23Z")

</div>

Hello!

On Fri, Jul 01, 2011 at 11:58:08AM -0400, bindsocket wrote:

> Having a huge problem with the auth\_basic. Despite putting in the exact  
> same lines as what I found in many examples, the web server is still  
> allowing access even without sending any authorization.  
> Relevent conf bits:
> 
> server {  
> listen 80;

[…]

> ## Default location
> 
> ```
> location / {
> index index.php;
> 
> auth_basic "Ingester";
> auth_basic_user_file .htpasswd;
> 
> ```

You have auth\_basic in your “location /”, so everything that ends  
up here will be protected.

[…]

> ## Parse all .php file in the /var/www directory
> 
> ```
> location ~ .php$ {
> fastcgi_pass backend;
> 
> ```

But you don’t have auth\_basic in “location ~ .php$” (btw, you  
missed "" before “.”), and anything here won’t be protected.

You have to move auth\_basic to server{} level to protect  
everything (or add it to all relevant locations if you have some  
which doesn’t need protection).

Maxim D.

---

<div class="post-metadata">

**Author:** ![bindsocket](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/898d66/32.png) [@bindsocket](https://www.ruby-forum.com/u/bindsocket)\
**Post date:** [July 1, 2011, 6:20pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982/3 "2011-07-01T18:20:14Z")

</div>

On 7/1/11 11:58 AM, bindsocket wrote:

> ```
> '"$request" $http_content_length $status
> location / {
> 
> fastcgi_param CONTENT_TYPE $content_type;
> }
> 
> ```

The above location block is outside the location block that handles PHP  
scripts.

You may try

## Default location

```
location / {
    index index.php;

    auth_basic "Ingester";
    auth_basic_user_file .htpasswd;

    rewrite ^index.php(.*)$ /index.php?/$1 last;
    if (!-f $request_filename) {
            rewrite ^/(.*)$ /index.php?/$1 last;
            break;
    }

```

location ~ .php {  
fastcgi pass backend;  
…  
}

```
}

```

Not also that this is an inefficient setup using “if”. See  
[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/IfIsEvil). A “try\_files” expression would be more  
efficient.

Something like

server {

…

location / {  
index index.php;

```
    auth_basic "Ingester";
    auth_basic_user_file .htpasswd;

    rewrite ^index.php(.*)$ /index.php?/$1 last;
    try_files $uri $uri/ @rfallback;

```

location ~ .php {  
fastcgi pass backend;  
…  
}

```
}

location @fallback {

```

rewrite ^/(.\*)$ /index.php?/$1 last;  
}

```
...

```

}

> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,211601,211601#msg-211601](http://forum.nginx.org/read.php?2,211601,211601#msg-211601)
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

–  
Jim O.

---

<div class="post-metadata">

**Author:** ![bindsocket](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/898d66/32.png) [@bindsocket](https://www.ruby-forum.com/u/bindsocket)\
**Post date:** [July 5, 2011, 7:49pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982/4 "2011-07-05T19:49:43Z")

</div>

Thanks everyone for the help and also for actually showing me how the  
whole location thing is processed. Also, I had read the IfIsEvil post  
and had it on my list of things to fix but never got far enough up the  
priority scale to actually do. Now, thanks to you guys I do not have to  
worry about that anymore.

Incidentally, I haven’t looked very hard but I do not see a way to do  
same thing I know how to do in Apache where only certain users are  
allowed access to certain directories. Being able to do this would  
simply the next step in tweaking the config file.

Thanks,  
Brian

Posted at Nginx Forum:

> **[Re: auth\_basic not requiring Authorization](https://forum.nginx.org/read.php?2,211601,211972#msg-211972)**
>
> Having a huge problem with the auth\_basic. Despite putting in the exact same lines as what I found in many examples, the web server is still allowing access even without sending any authorization. Relevent conf bits: server { listen 80; server\_name...

---

<div class="post-metadata">

**Author:** ![bindsocket](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/898d66/32.png) [@bindsocket](https://www.ruby-forum.com/u/bindsocket)\
**Post date:** [July 1, 2011, 8:28pm UTC](https://www.ruby-forum.com/t/auth-basic-not-requiring-authorization/208982/5 "2011-07-01T20:28:37Z")

</div>

On Jul 1, 2011, at 19:58 , bindsocket wrote:

> ```
> '"$request" $http_content_length $status
> 
> ```
> 
> location / {
> 
> ```
> fastcgi_param CONTENT_TYPE $content_type;
> 
> ```
> 
> }
> 
> ## Disable viewing .htaccess & .htpassword
> 
> location ~ /.ht {  
> deny all;  
> }  
> }

location / {  
index index.php;

```
   auth_basic "Ingester";
   auth_basic_user_file .htpasswd;

   try_files $uri /index.php?$uri;

   location ~ ^/index.php(/.*)$ {
       fastcgi_index index.php;
       fastcgi_param SCRIPT_FILENAME $document_root$index.php;
       include /etc/nginx/fastcgi_params;
       fastcgi_param QUERY_STRING $1;
       ...
   }

   location ~ \.php$ {
       fastcgi_pass backend;
       fastcgi_index index.php;
       fastcgi_param SCRIPT_FILENAME 

```

$document\_root$fastcgi\_script\_name;  
include /etc/nginx/fastcgi\_params;  
fastcgi\_param QUERY\_STRING $query\_string;  
…  
}

}

## Disable viewing .htaccess & .htpassword

location ~ /.ht {  
deny all;  
}  
}

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**