# Basic Auth only for external IPs and not localhost or LAN networks

**URL:** <https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824>\
**Category:** NGINX\
**Created:** [February 15, 2012, 5:34am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824 "2012-02-15T05:34:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [February 15, 2012, 5:34am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824/1 "2012-02-15T05:34:10Z")

</div>

Hi all,

I have a location directive with basic auth in it.

```
    location / {

               auth_basic "Admin Login";

               auth_basic_user_file /etc/nginx/.htpasswd;

```

How do I specify a rule such that the basic auth is applied only to  
external IPs and not to 127.0.0.x, 192.0.x & 10.0.x?

I run Jenkins from a sub-domain and my git post-commit-hook needs to hit  
a  
URL under this location directive to trigger continuous integration. But  
this Jenkins cannot handle basic auth that blocks the URL submit.

-Quintin

---

<div class="post-metadata">

**Author:** ![Quintin\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/q/13edae/32.png) [@Quintin\_P](https://www.ruby-forum.com/u/Quintin_P)\
**Post date:** [February 15, 2012, 6:02am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824/2 "2012-02-15T06:02:12Z")

</div>

On 15 Fev 2012 04h33 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi all,
> 
> I have a location directive with basic auth in it.
> 
> location / {
> 
> auth\_basic “Admin Login”;
> 
> auth\_basic\_user\_file /etc/nginx/.htpasswd;  
> }

> How do I specify a rule such that the basic auth is applied only to  
> external IPs and not to 127.0.0.x, 192.0.x & 10.0.x?
> 
> I run Jenkins from a sub-domain and my git post-commit-hook needs to  
> hit a URL under this location directive to trigger continuous  
> integration. But this Jenkins cannot handle basic auth that blocks  
> the URL submit.

At the http level:

geo $is\_authorized {  
default 0;  
127.0.0.1 1;  
192.0.0.0/16 1;  
10.0.0.0/16 1;  
}

On the vhost:

location / {  
error\_page 418 @no-auth;

```
if ($is_authorized) {
    return 418;
}

auth_basic "Admin Login";
auth_basic_user_file .htpasswd;

# ... content handler directives here or default (static)

```

}

location @no-auth {  
# … content handler directives here or default (static)  
}

— appa

---

<div class="post-metadata">

**Author:** ![Quintin\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/q/13edae/32.png) [@Quintin\_P](https://www.ruby-forum.com/u/Quintin_P)\
**Post date:** [February 15, 2012, 10:10am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824/3 "2012-02-15T10:10:08Z")

</div>

Hello!

On Wed, Feb 15, 2012 at 10:03:13AM +0530, Quintin P. wrote:

> How do I specify a rule such that the basic auth is applied only to  
> external IPs and not to 127.0.0.x, 192.0.x & 10.0.x?

Use “satisfy any”, see

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html)**

```
location / {
    satisfy any;

    auth_basic "Admin Login";
    auth_basic_user_file /etc/nginx/.htpasswd;

    allow 127.0.0.0/24;
    allow 192.0.0.0/16;
    allow 10.0.0.0/16;
    deny all;
}

```

Just a side note: the “192.0.x” should probably be “192.168.x”  
instead, but you should get the idea anyway.

Maxim D.

---

<div class="post-metadata">

**Author:** ![Quintin\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/q/13edae/32.png) [@Quintin\_P](https://www.ruby-forum.com/u/Quintin_P)\
**Post date:** [February 15, 2012, 6:48am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824/4 "2012-02-15T06:48:00Z")

</div>

On 15 Fev 2012 05h01 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > auth\_basic\_user\_file /etc/nginx/.htpasswd;
> 
> At the http level:
> 
> geo $is\_authorized {  
> default 0;  
> 127.0.0.1 1;  
> 192.0.0.0/16 1;  
> 10.0.0.0/16 1;  
> }

Also using auth\_request (avoids duplicating the location):

location / {  
auth\_basic “Admin Login”;  
auth\_basic\_user\_file .htpasswd;  
satisfy any;  
auth\_request /auth;

```
# ... content handler directives here or default (static)

```

}

location /auth {  
if ($is\_authorized) {  
return 200;  
}  
return 403;  
}

— appa

---

<div class="post-metadata">

**Author:** ![Quintin\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/q/13edae/32.png) [@Quintin\_P](https://www.ruby-forum.com/u/Quintin_P)\
**Post date:** [February 15, 2012, 11:17am UTC](https://www.ruby-forum.com/t/basic-auth-only-for-external-ips-and-not-localhost-or-lan-networks/216824/5 "2012-02-15T11:17:22Z")

</div>

Ha!

What a simple solution.

Thanks a lot!

-Quintin