# Disabling basic\_auth with rewrites **URL:** \ **Category:** NGINX\ **Created:** [May 19, 2011, 3:59pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155 "2011-05-19T15:59:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [May 19, 2011, 3:59pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/1 "2011-05-19T15:59:55Z")
Hi, I would like to generally protect my site but allow one certain path. However, I need rewrites to forward the requested path to a PHP file. Unfortunately the following does not work: location ~ ^/feeds/importer/.\* { auth\_basic off; rewrite ^/(.\*)$ /index.php?q=$1; } location ~ .php$ { auth\_basic “protected”; auth\_basic\_user\_file /etc/nginx/htpasswd/protected; fastcgi\_split\_path\_info ^(.+.php)(/.+)$; include fastcgi\_params; fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name; fastcgi\_intercept\_errors on; fastcgi\_pass $socket; # workaround as fastcgi\_param cannot be used inside if statements set $https off; if ($scheme = https) { set $https on; } fastcgi\_param HTTPS $https; fastcgi\_read\_timeout 6000; } location ~ ^/(.\*) { auth\_basic “protected”; auth\_basic\_user\_file /etc/nginx/htpasswd/protected; try\_files $uri /index.php?q=$1&$args; } Any ideas how to unprotect the first location? Posted at Nginx Forum: > **[Disabling basic\_auth with rewrites](https://forum.nginx.org/read.php?2,199278,199278#msg-199278)** > > Hi, I would like to generally protect my site but allow one certain path. However, I need rewrites to forward the requested path to a PHP file. Unfortunately the following does not work: location ~ ^/feeds/importer/.\* { auth\_basic off; rewrite... ---
**Author:** ![klausi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/977dab/32.png) [@klausi](https://www.ruby-forum.com/u/klausi)\ **Post date:** [May 19, 2011, 4:10pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/2 "2011-05-19T16:10:27Z")
Hello! On Thu, May 19, 2011 at 09:59:37AM -0400, klausi wrote: > if ($scheme = https) { > } > > Any ideas how to unprotect the first location? ``` location / { auth_basic "protected"; auth_basic_user_file /etc/nginx/htpasswd/protected; ... location ~ \.php$ { fastcgi_pass ... ... } } location /feeds/importer/ { ... location ~ \.php$ { fastcgi_pass ... ... } } ``` Maxim D. ---
**Author:** ![klausi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/977dab/32.png) [@klausi](https://www.ruby-forum.com/u/klausi)\ **Post date:** [May 19, 2011, 6:43pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/3 "2011-05-19T18:43:44Z")
## Maxim D. Wrote: > ``` > } > } > > location /feeds/importer/ { > ... > > location ~ \.php$ { > fastcgi_pass ... > ... > } > } > > ``` Thanks for the quick reply, nested locations are nice, but they do not help in this special case. A request to /feeds/importer/\* has to be rewritten to /index.php?q=feeds/importer/\* and that should not be protected. Is unprotecting a path with a special query possible at all? Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,199278,199319#msg-199319](http://forum.nginx.org/read.php?2,199278,199319#msg-199319) ---
**Author:** ![klausi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/977dab/32.png) [@klausi](https://www.ruby-forum.com/u/klausi)\ **Post date:** [May 19, 2011, 9:17pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/4 "2011-05-19T21:17:34Z")
On Thu, May 19, 2011 at 10:10:59PM +0400, Maxim D. wrote: > > > /etc/nginx/htpasswd/protected; > > ``` > ... > > ``` > > Note that the only goal of rewrite is to properly change url while > correctly escaping new arguments and stripping old ones (note > trailing ‘?’), as you probably don’t want to allow unauthenticated > users to supply arbitrary arguments to your index.php. Due to > ‘break’ request doesn’t leave the location in question after > rewrite and processed there. My suggestion is to not use rewrite at all: ``` location /feeds/importer/ { location ~ ^/(.*) { fastcgi_pass ... fastcgi_param SCRIPT_FILENAME /path/to/index.php; fastcgi_param QUERY_STRING q=$1; ... } ``` – Igor S. ---
**Author:** ![klausi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/977dab/32.png) [@klausi](https://www.ruby-forum.com/u/klausi)\ **Post date:** [May 19, 2011, 8:11pm UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/5 "2011-05-19T20:11:28Z")
Hello! On Thu, May 19, 2011 at 12:43:03PM -0400, klausi wrote: > > ``` > > fastcgi_pass ... > > } > > } > > > > ``` > > Thanks for the quick reply, nested locations are nice, but they do not > help in this special case. A request to /feeds/importer/\* has to be > rewritten to /index.php?q=feeds/importer/\* and that should not be > protected. Is unprotecting a path with a special query possible at all? Ah, sorry, I missed you actually want /feeds/importer/… to be fully handled by index.php. This makes configuration even simplier: ``` location / { auth_basic ... ... location ~ \.php$ { fastcgi_pass ... ... } } location /feeds/importer/ { rewrite ^/(.*) /index.php?q=$1? break; fastcgi_pass ... ... } ``` Note that the only goal of rewrite is to properly change url while correctly escaping new arguments and stripping old ones (note trailing ‘?’), as you probably don’t want to allow unauthenticated users to supply arbitrary arguments to your index.php. Due to ‘break’ request doesn’t leave the location in question after rewrite and processed there. Maxim D. ---
**Author:** ![klausi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/977dab/32.png) [@klausi](https://www.ruby-forum.com/u/klausi)\ **Post date:** [May 20, 2011, 10:00am UTC](https://www.ruby-forum.com/t/disabling-basic-auth-with-rewrites/207155/6 "2011-05-20T10:00:40Z")
Hello! On Thu, May 19, 2011 at 11:16:56PM +0400, Igor S. wrote: > > > > ``` > > > > auth_basic_user_file > > > > ... > > > > > > > > ``` > > > > > > protected. Is unprotecting a path with a special query possible at all? > > > fastcgi\_pass … > > ``` > location ~ ^/(.*) { > fastcgi_pass ... > fastcgi_param SCRIPT_FILENAME /path/to/index.php; > fastcgi_param QUERY_STRING q=$1; > ... > } > > ``` There is a problem: you need urlescape() function then. Else request like /feeds/importer/&doevil=1 will naturally do evil, i.e. “doevil=1” will be seen by index.php as a separate argument. Maxim D.