# Htpasswd protection prompts for index.php download

**URL:** <https://www.ruby-forum.com/t/htpasswd-protection-prompts-for-index-php-download/185315>\
**Category:** NGINX\
**Created:** [March 18, 2010, 1:02am UTC](https://www.ruby-forum.com/t/htpasswd-protection-prompts-for-index-php-download/185315 "2010-03-18T01:02:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ppnx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/41988e/32.png) [@ppnx](https://www.ruby-forum.com/u/ppnx)\
**Post date:** [March 18, 2010, 1:02am UTC](https://www.ruby-forum.com/t/htpasswd-protection-prompts-for-index-php-download/185315/1 "2010-03-18T01:02:25Z")

</div>

I could not find the information on the web or in the wiki, so I try  
this list. I am the user of a free hosting service using nginx. So I  
cannot acces or edit conf files myself, but I can ask the admin and he  
will do it for me.

Basically, I want to protect whole folders. I think that I have managed  
to do that by asking the admin to add these lines to the nginx.conf  
file:

# Password Protect important Directories

location ~ /srv/www/users/me/(folder1|folder2)/.\* {  
auth\_basic “Restricted”;  
auth\_basic\_user\_file /srv/www/users/me/folder1/.htpasswd;  
}

This does protect all files in folder1 and folder2. However, after  
entering the password, instead of seeing the index.php file display the  
page on screen, my browser pops up this download dialogue:

[http://img706.imageshack.us/img706/938/ss20100318005424.jpg](http://img706.imageshack.us/img706/938/ss20100318005424.jpg)

How can I avoid this behavior?

Posted at Nginx Forum:

> **[htpasswd protection prompts for index.php download](https://forum.nginx.org/read.php?2,65055,65055#msg-65055)**
>
> I could not find the information on the web or in the wiki, so I try this list. I am the user of a free hosting service using nginx. So I cannot acces or edit conf files myself, but I can ask the admin and he will do it for me. Basically, I want to...

---

<div class="post-metadata">

**Author:** ![ppnx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/41988e/32.png) [@ppnx](https://www.ruby-forum.com/u/ppnx)\
**Post date:** [March 18, 2010, 1:10am UTC](https://www.ruby-forum.com/t/htpasswd-protection-prompts-for-index-php-download/185315/2 "2010-03-18T01:10:02Z")

</div>

On Thu, Mar 18, 2010 at 7:01 AM, ppnx [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I could not find the information on the web or in the wiki, so I try this list. I am the user of a free hosting service using nginx. So I cannot acces or edit conf files myself, but I can ask the admin and he will do it for me.
> 
> Basically, I want to protect whole folders. I think that I have managed to do that by asking the admin to add these lines to the nginx.conf file:
> 
> # Password Protect important Directories
> 
> location ~ /srv/www/users/me/(folder1|folder2)/.\* {  
> auth\_basic “Restricted”;  
> auth\_basic\_user\_file /srv/www/users/me/folder1/.htpasswd;  
> }

location ~ /srv/www/users/me/(folder1|folder2)/.\*.php$ {  
auth\_basic “Restricted”;  
auth\_basic\_user\_file /srv/www/users/me/folder1/.htpasswd;  
fastcgi\_pass …;  
…  
}

–  
O\< ascii ribbon campaign - stop html mail - [www.asciiribbon.org](http://www.asciiribbon.org)

---

<div class="post-metadata">

**Author:** ![ppnx](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/41988e/32.png) [@ppnx](https://www.ruby-forum.com/u/ppnx)\
**Post date:** [March 18, 2010, 1:23am UTC](https://www.ruby-forum.com/t/htpasswd-protection-prompts-for-index-php-download/185315/3 "2010-03-18T01:23:29Z")

</div>

This is the expected behavior. I would guess that your configuration  
file contains a different location block for handling files with a  
“.php” extension. In this case nginx will only match one location. See  
[Module ngx\_http\_core\_module](http://wiki.nginx.org/NginxHttpCoreModule#location).

To avoid serving the index.php file as a text file you can try using  
nested location blocks. This is an undocumented feature and can have  
unpredictable results, but in this case I guess it will work OK.

Try something like:

location ~ /srv/www/users/me/(folder1|folder2)/.\* {  
auth\_basic “Restricted”;  
auth\_basic\_user\_file /srv/www/users/me/folder1/.htpasswd;  
location ~.php {  
fastcgi\_pass 127.0.0.1:9000; # substitute here with appropriate PHP  
backend address or proxy\_pass statement and parameters.  
…  
}  
}

Posted at Nginx Forum:

> **[Re: htpasswd protection prompts for index.php download](https://forum.nginx.org/read.php?2,65055,65059#msg-65059)**
>
> I could not find the information on the web or in the wiki, so I try this list. I am the user of a free hosting service using nginx. So I cannot acces or edit conf files myself, but I can ask the admin and he will do it for me. Basically, I want to...