# Authenticated session downloads auth\_basic protected php files

**URL:** <https://www.ruby-forum.com/t/authenticated-session-downloads-auth-basic-protected-php-files/223333>\
**Category:** NGINX\
**Created:** [September 30, 2012, 12:52am UTC](https://www.ruby-forum.com/t/authenticated-session-downloads-auth-basic-protected-php-files/223333 "2012-09-30T00:52:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [September 30, 2012, 12:52am UTC](https://www.ruby-forum.com/t/authenticated-session-downloads-auth-basic-protected-php-files/223333/1 "2012-09-30T00:52:54Z")

</div>

Hi I’m a nginx newbie, but I think I’m experiencing something seriously  
strange. I’m not sure I can reproduce the steps needed, but the thing is  
that I ended up nginx downloading protected php files from the site!

Step 1. make a normal site with say one php file  
Step 2. make a auth\_basic protected folder on it  
Step 3. authenticate yourself in Google Chrome (maybe it works in others  
too)  
Step 4. now modify the config such that a php file what wasn’t protected  
before is protected now, reload  
Step 5. now if you load the new php file in Chrome, instead of asking  
for  
the authenticate dialog, or parsing the file properly, it downloads it!  
I  
mean the pure PHP file with all it’s code and plaintext content inside  
it!

I’m not sure that the above steps are the precise steps required to  
reproduce the bug, but I’ve repeatedly ended up downloading php files  
from  
the server. Closing Chrome and cleaning the cache fixed it.

Posted at Nginx Forum:

> **[authenticated session downloads auth\_basic protected php files](https://forum.nginx.org/read.php?2,231253,231253#msg-231253)**
>
> Hi I'm a nginx newbie, but I think I'm experiencing something seriously strange. I'm not sure I can reproduce the steps needed, but the thing is that I ended up nginx downloading protected php files from the site! Step 1. make a normal site with say...

---

<div class="post-metadata">

**Author:** ![zsero](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/eada6e/32.png) [@zsero](https://www.ruby-forum.com/u/zsero)\
**Post date:** [September 30, 2012, 1:01am UTC](https://www.ruby-forum.com/t/authenticated-session-downloads-auth-basic-protected-php-files/223333/2 "2012-09-30T01:01:05Z")

</div>

OK, I think my case is much simpler. Having

location = /something.php {  
auth\_basic “Restricted”;  
auth\_basic\_user\_file …;  
}

before

location ~ .php$ {  
fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name;  
fastcgi\_pass unix:/home/kek/http/private/php.socket;  
include fastcgi\_params;  
try\_files $uri =404;  
}

Stops at the first step. Is there any way to password protect a single  
php  
file AND keep parsing it as php? Or should I copy and paste those lines  
into  
the first one?

Posted at Nginx Forum:

> **[Re: authenticated session downloads auth\_basic protected php files](https://forum.nginx.org/read.php?2,231253,231254#msg-231254)**
>
> Hi I'm a nginx newbie, but I think I'm experiencing something seriously strange. I'm not sure I can reproduce the steps needed, but the thing is that I ended up nginx downloading protected php files from the site! Step 1. make a normal site with say...