# HT Auth Problem

**URL:** <https://www.ruby-forum.com/t/ht-auth-problem/169666>\
**Category:** NGINX\
**Created:** [June 6, 2009, 3:16pm UTC](https://www.ruby-forum.com/t/ht-auth-problem/169666 "2009-06-06T15:16:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![matt91](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3e96dc/32.png) [@matt91](https://www.ruby-forum.com/u/matt91)\
**Post date:** [June 6, 2009, 3:16pm UTC](https://www.ruby-forum.com/t/ht-auth-problem/169666/1 "2009-06-06T15:16:43Z")

</div>

I am having a problem with HT Auth where it will protect the directory  
and all files in it except the php files, I think this is a problem with  
nginx passing all php files for processing by fcgi before the  
authentication. For example [mysite.com/imnottelling/](http://mysite.com/imnottelling/) and  
[mysite.com/imnottelling/hello.html](http://mysite.com/imnottelling/hello.html) is protected however  
[mysite.com/imnottelling/anything.php](http://mysite.com/imnottelling/anything.php) is not. Here is my virtual host  
config file for the domain:

server {  
listen 81;

server\_name [tributes-direct.co.uk](http://tributes-direct.co.uk) [www.tributes-direct.co.uk](http://www.tributes-direct.co.uk)  
\*.tributes-direct.co.uk;

access\_log /var/log/nginx/localhost.access.log;

rewrite ^/adamcarter$  
/tributedetails.php?name=elvis\_adam\_carter&page=1 break;  
rewrite ^/bg\_sound\_([^_]\*).xspf$  
/includes/bg\_audio\_player/bg\_sound.php?tributeid=$1 break;  
rewrite ^/adamcarter$  
/tributedetails.php?name=elvis\_adam\_carter&page=1 break;  
rewrite ^/elvis$ /tributeindex.php?artiste=elvis break;  
rewrite ^/_([^/]_)$ /tributedetails.php?name=$1 break;  
rewrite ^/\_(._)/page/(._)$ /tributedetails.php?name=$1&page=$2 break;  
rewrite ^/\_(._)/art/(._)$ /tributedetails.php?name=$1&artisteid=$2  
break;  
rewrite ^/\_(._)/cat/(.\*)$ /tributedetails.php?name=$1&cat=$2 break;

location / {  
root /var/www/tributes-direct.co.uk;  
index index.php index.html index.htm;  
}  
location /imnottelling/\* {  
root /var/www/tributes-direct.co.uk;  
index index.php index.html index.htm;  
auth\_basic “Restricted”;  
auth\_basic\_user\_file  
/var/www/tributes-direct.co.uk/imnottelling/.htpasswd;  
}

#error\_page 404 /var/www/err/404.html;

# redirect server error pages to the static page /50x.html

# 

#error\_page 500 502 503 504 /50x.html;  
#location = /50x.html {

# root /var/www/err;

#}

location ~ .php$ {  
fastcgi\_pass 127.0.0.1:9000;  
fastcgi\_index index.php;  
fastcgi\_param SCRIPT\_FILENAME  
/var/www/tributes-direct.co.uk/$fastcgi\_script\_name;  
include fastcgi\_params;  
}

serve static files directly  
location ~ .(jpg|jpeg|gif|css|png|js|ico)$ {  
access\_log off;  
expires 30d;  
}

# protect htaccess

location ~ /. {  
deny all;  
}  
}

And yep, I know the .htpasswd is in an accessible location 😉

Thank you for your help.

Matt

Posted at Nginx Forum:

> **[HT Auth Problem](https://forum.nginx.org/read.php?2,2667,2667#msg-2667)**
>
> I am having a problem with HT Auth where it will protect the directory and all files in it except the php files, I think this is a problem with nginx passing all php files for processing by fcgi before the authentication. For example...

---

<div class="post-metadata">

**Author:** ![matt91](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3e96dc/32.png) [@matt91](https://www.ruby-forum.com/u/matt91)\
**Post date:** [June 6, 2009, 5:22pm UTC](https://www.ruby-forum.com/t/ht-auth-problem/169666/2 "2009-06-06T17:22:44Z")

</div>

Just to note “serve static files directly” is now commented out, this  
was not the cause of the problem though.

Posted at Nginx Forum:

> **[Re: HT Auth Problem](https://forum.nginx.org/read.php?2,2667,2671#msg-2671)**
>
> I am having a problem with HT Auth where it will protect the directory and all files in it except the php files, I think this is a problem with nginx passing all php files for processing by fcgi before the authentication. For example...

---

<div class="post-metadata">

**Author:** ![matt91](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3e96dc/32.png) [@matt91](https://www.ruby-forum.com/u/matt91)\
**Post date:** [June 6, 2009, 5:57pm UTC](https://www.ruby-forum.com/t/ht-auth-problem/169666/3 "2009-06-06T17:57:19Z")

</div>

You have to use a nested location like  
location /imnottelling {  
auth\_basic “Restricted”;  
auth\_basic\_user\_file /var/www/tributes-direct.co.uk/  
imnottelling/.htpasswd;  
location ~ .\*.php$ {  
fastcgi\_pass 127.0.0.1:9000;  
fastcgi\_index index.php;  
fastcgi\_param SCRIPT\_FILENAME /var/www/tributes-direct.co.uk/  
imnottelling/$fastcgi\_script\_name;  
include fastcgi\_params;  
}  
}

Igor has warned that nested locations has bugs in inheritance but that  
this one will work correctly.  
[http://marc.info/?l=nginx&m=124301482813284&w=2](http://marc.info/?l=nginx&m=124301482813284&w=2)

Also a note its easier if you use  
fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name;  
in your fastcgi\_params. Then if you have your root’s set right and  
redefined it will properly fill the correct SCRIPT\_FILENAME without  
you having to do it in each of your php blocks if you have multiple of  
them. Just 1 less thing that is needed to be redefined.

Rob

---

<div class="post-metadata">

**Author:** ![matt91](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/3e96dc/32.png) [@matt91](https://www.ruby-forum.com/u/matt91)\
**Post date:** [June 8, 2009, 12:23pm UTC](https://www.ruby-forum.com/t/ht-auth-problem/169666/4 "2009-06-08T12:23:46Z")

</div>

The problem is clear and you have no need of nested locations (though  
that is one possible solution and hints at the issue). Observe:

```
   location ~ \.php$ {
           fastcgi_pass 127.0.0.1:9000;
           fastcgi_index index.php;
           fastcgi_param SCRIPT_FILENAME

```

/var/www/tributes-direct.co.uk/$fastcgi\_script\_name;  
include fastcgi\_params;  
}

This regular expression indeed covers all PHP files. There is no auth  
here, so it does not ask for auth, only for the resources that ARE  
under a location with auth. You can try a nested location, or you can  
add a second more specific php handling location block that also has  
auth in it, or you can make an internal location for PHP and pass back  
to it for the regular expressions. The middle method is most  
straightforward (and not demonstrated yet) and might be implemented  
like so:

```
   location ~ ^/protectedstuff/.*\.php$ {
           auth_basic "Enter Credentials";
           auth_basic_user_file /path/to/auth;
           fastcgi_pass 127.0.0.1:9000;
           fastcgi_index index.php;
           fastcgi_param SCRIPT_FILENAME

```

/var/www/tributes-direct.co.uk/$fastcgi\_script\_name;  
include fastcgi\_params;  
}