# Basic Authentication and PHP files

**URL:** <https://www.ruby-forum.com/t/basic-authentication-and-php-files/203205>\
**Category:** NGINX\
**Created:** [February 15, 2011, 4:27pm UTC](https://www.ruby-forum.com/t/basic-authentication-and-php-files/203205 "2011-02-15T16:27:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 15, 2011, 4:27pm UTC](https://www.ruby-forum.com/t/basic-authentication-and-php-files/203205/1 "2011-02-15T16:27:42Z")

</div>

I have a configuration block like this :

```auto
  location /members/ {
    index main.php;
  }

  location ~ ^/members/(?:text1|text2|text3)/(?!noinclude)[^\/]+/ {
    auth_basic "Restricted Area";
    auth_basic_user_file /home/password/.htpasswd;
    rewrite ^\/(members\/[^\/]+\/[^\/]+)\/$ /gallery.php?path=$1&page=1
last;
    rewrite ^\/(members\/[^\/]+\/[^\/]+)\/page([0-9]+)\.php$
/gallery.php?path=$1&page=$2 last;
  }

        location ~ \.php$ {
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME
$document_root$fastcgi_script_n$
                include fastcgi_params;
        }

```

The problem is that whenever I go to  
[http://mydomain.com/members/text1/anything/](http://mydomain.com/members/text1/anything/) or  
[http://mydomain.com/members/text1/anything/pageX.php](http://mydomain.com/members/text1/anything/pageX.php), it correctly  
displays the redirected page from gallery.php correctly, but it requires  
no authentication. The images and other elements embedded on the page  
from within the directory requires authentication, however.

I’m using v0.8.54.

Posted at Nginx Forum:

> **[Basic Authentication and PHP files](https://forum.nginx.org/read.php?2,175467,175467#msg-175467)**
>
> I have a configuration block like this : \[code\] location /members/ { index main.php; } location ~ ^/members/(?:text1|text2|text3)/(?!noinclude)\[^\\/\]+/ { auth\_basic "Restricted Area"; auth\_basic\_user\_file

---

<div class="post-metadata">

**Author:** ![Ellimist](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7bcc69/32.png) [@Ellimist](https://www.ruby-forum.com/u/Ellimist)\
**Post date:** [February 15, 2011, 5:50pm UTC](https://www.ruby-forum.com/t/basic-authentication-and-php-files/203205/2 "2011-02-15T17:50:25Z")

</div>

Hello!

On Tue, Feb 15, 2011 at 10:26:29AM -0500, Ellimist wrote:

> ```
> rewrite ^\/(members\/[^\/]+\/[^\/]+)\/$ /gallery.php?path=$1&page=1
> include fastcgi_params;
> }
> 
> ```
> 
> [/code]
> 
> The problem is that whenever I go to  
> [http://mydomain.com/members/text1/anything/](http://mydomain.com/members/text1/anything/) or  
> [http://mydomain.com/members/text1/anything/pageX.php](http://mydomain.com/members/text1/anything/pageX.php), it correctly  
> displays the redirected page from gallery.php correctly, but it requires  
> no authentication. The images and other elements embedded on the page  
> from within the directory requires authentication, however.

Rewrite are executed before authentication, so you have to switch  
on authentication in location where request is actually processed  
(that is, rewritten one).

Additionally, /gallery.php is anyway unprotected with your config,  
so it’s possible to request anything without authentication by  
constructing appropriate url.

To resolve both issues it would be enough to add location for  
gallery.php with auth\_basic, i.e.

```
location = /gallery.php {
    auth_basic ...
    fastcgi_pass ...
    ...
}

```

Though you may want to rewrite your config to avoid rewrites  
altogether to something like

```
location /members/ {
    auth_basic ...

    location ~ ^/(?<path>members/[^/]+/[^/]+)/$ {
        fastcgi_pass ...
        fastcgi_param SCRIPT_FILENAME $document_root/gallery.php;
        fastcgi_param QUERY_STRING path=$path&page=1;
        ...
    }

    location ~ 

```

^/(?members/[^/]+/[^/]+)/page(?[0-9]+).php$ {  
fastcgi\_pass …  
fastcgi\_param SCRIPT\_FILENAME $document\_root/gallery.php;  
fastcgi\_param QUERY\_STRING path=$path&page=$page;  
…  
}  
}

This aproach is believed to be much more maintainable than using  
rewrites.

Maxim D.