# Conditional http auth **URL:** \ **Category:** NGINX\ **Created:** [December 3, 2010, 9:50pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054 "2010-12-03T21:50:21Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\ **Post date:** [December 3, 2010, 9:50pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/1 "2010-12-03T21:50:21Z")
Got this idea off IRC, but it looks like variables don’t expand: set $realm “enter your password”; if ($http\_via ~\* “.somehost.net”) { set $realm off; } auth\_basic $realm; auth\_basic\_user\_file /etc/nginx/confs/htpasswd.test; Any ideas on how to do conditional auth? auth\_basic and such is not allowed under “if” … trying to figure out some way to dynamically do this. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 10:01pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/2 "2010-12-03T22:01:41Z")
Hi, On 03/12/2010 22:49, Michael S. wrote: > Any ideas on how to do conditional auth? > > auth\_basic and such is not allowed under “if” … trying to figure out > some way to dynamically do this. > I think if you put the if() inside the server rather than inside a > location it should work. e.g. server { set $realm “enter your password”; if ($http\_via ~\* “.somehost.net”) { ``` set $realm off; ``` } location / { auth\_basic $realm; auth\_basic\_user\_file /etc/nginx/confs/htpasswd.test; } … Though I’ve not tested it. Cheers, Marcus. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 10:06pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/3 "2010-12-03T22:06:05Z")
On Fri, Dec 3, 2010 at 1:00 PM, Eugaia [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > auth\_basic $realm; This is still the problem… auth\_basic doesn’t seem to accept variables. If so, my original post -should- work. It still relies on that. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 10:08pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/4 "2010-12-03T22:08:35Z")
No, it shouldn’t. You can jump to named location inside if statement, and change authorization configuration there. 2010 12 4 00:05 пользователь “Michael S.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) написал: ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 10:12pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/5 "2010-12-03T22:12:21Z")
I thought of that - care to show an example of what you mean in pseudo config? The way I was thinking about it might be wrong. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 10:23pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/6 "2010-12-03T22:23:39Z")
On 03/12/2010 23:00, Eugaia wrote: > > > > e.g. > location / { > auth\_basic $realm; > auth\_basic\_user\_file /etc/nginx/confs/htpasswd.test; > > } It appears that auth\_basic doesn’t take variables, so this won’t work anyway. Marcus. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 4, 2010, 12:19pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/7 "2010-12-04T12:19:59Z")
On Sat, Dec 4, 2010 at 4:49 AM, Michael S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > With the ngx\_lua [1] module enabled, it’s trivial: set\_by\_lua $realm ’ if string.match(ngx.var.http\_via, “.somehost.net”) then return “off” else return “enter your password” end’; auth\_basic $realm; auth\_basic\_user\_file /etc/nginx/confs/htpasswd.test; This should have great performance even if you’re using Lua 😉 Cheers, -agentzh [1] [Issues · openresty/lua-nginx-module · GitHub](https://github.com/chaoslawful/lua-nginx-module/issues/#issue/8) ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 3, 2010, 11:05pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/8 "2010-12-03T23:05:39Z")
On Fri, Dec 3, 2010 at 1:07 PM, Boris D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > No, it shouldn’t. > > You can jump to named location inside if statement, and change authorization > configuration there. So are you saying something like if ($http\_via ~\* “.somehost.net”) { rewrite @protected permanent; } location @protected { auth\_basic etc. } wouldn’t I have to define the entire location / twice then? once _inside_ of that named location (because I need the entire base location and such to be active, just behind auth) ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 4, 2010, 4:43pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/9 "2010-12-04T16:43:46Z")
Hi, On 04/12/2010 13:18, agentzh wrote: > auth\_basic\_user\_file /etc/nginx/confs/htpasswd.test; > > This should have great performance even if you’re using Lua 😉 > I’ve not tested it, but I had a quick look at the code and it appears > that auth\_basic doesn’t accept variables (yet), so regardless of the > setting mechanism, I don’t think it will work. Adding variable support to auth\_basic, though, could be useful it seems. Cheers, Marcus. ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 4, 2010, 12:24pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/10 "2010-12-04T12:24:22Z")
On Sat, Dec 4, 2010 at 7:18 PM, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > [1] [Issues · openresty/lua-nginx-module · GitHub](https://github.com/chaoslawful/lua-nginx-module/issues/#issue/8) Sorry, the link should be ``` https://github.com/chaoslawful/lua-nginx-module/ ``` Cheers, -agentzh ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 6, 2010, 1:03pm UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/11 "2010-12-06T13:03:44Z")
Igor - any way that this could be implemented? Variable expansion for auth\_basic? Or do you have any other ideas? ---
**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\ **Post date:** [December 5, 2010, 12:00am UTC](https://www.ruby-forum.com/t/conditional-http-auth/200054/12 "2010-12-05T00:00:00Z")
On Sat, Dec 4, 2010 at 7:41 AM, Eugaia [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’ve not tested it, but I had a quick look at the code and it appears that > auth\_basic doesn’t accept variables (yet), so regardless of the setting > mechanism, I don’t think it will work. > > Adding variable support to auth\_basic, though, could be useful it seems. Since it isn’t important enough to compile in lua just for this, I wouldn’t have really considered this an option anyway. But yes, I believe you’re still right. It still all relies on nginx allowing variables. That could be as simple as a two line patch or could be complex. I don’t know?