# Location recursive downloads php files

**URL:** <https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869>\
**Category:** NGINX\
**Created:** [July 20, 2013, 11:02pm UTC](https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869 "2013-07-20T23:02:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alcina](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@alcina](https://www.ruby-forum.com/u/alcina)\
**Post date:** [July 20, 2013, 11:02pm UTC](https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869/1 "2013-07-20T23:02:14Z")

</div>

I try to secure a specific folder and all files and subfolders with this  
location block:

```
location ^~ /folder1/admin {
    auth_basic "Login";
    auth_basic_user_file

```

/var/www/domain.tld/www/folder1/admin/.htpasswd;  
}

With this code nginx offers always to download the php files.

With this code everything works as expected except that files and  
subfolders  
are not secured:

```
location /folder1/admin {
    auth_basic "Login";
    auth_basic_user_file

```

/var/www/domain.tld/www/folder1/admin/.htpasswd;  
}

Why is that and how can I fix the problem from the first block?

Thanks.

Posted at Nginx Forum:

> **[Location recursive downloads php files](https://forum.nginx.org/read.php?2,241080,241080#msg-241080)**
>
> I try to secure a specific folder and all files and subfolders with this location block: location ^~ /folder1/admin { auth\_basic "Login"; auth\_basic\_user\_file /var/www/domain.tld/www/folder1/admin/.htpasswd; } Wit

---

<div class="post-metadata">

**Author:** ![Peleke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a88e57/32.png) [@Peleke](https://www.ruby-forum.com/u/Peleke)\
**Post date:** [July 21, 2013, 10:05am UTC](https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869/2 "2013-07-21T10:05:08Z")

</div>

On Sat, Jul 20, 2013 at 05:01:39PM -0400, Peleke wrote:

Hi there,

> With this code everything works as expected except that files and subfolders  
> are not secured:
> 
> ```
> location /folder1/admin {
> auth_basic "Login";
> auth_basic_user_file
> 
> ```
> 
> /var/www/domain.tld/www/folder1/admin/.htpasswd;  
> }
> 
> Why is that and how can I fix the problem from the first block?

In nginx, one request is handled in one location.

[http://nginx.org/r/location](http://nginx.org/r/location) describes the rules, so that you can know  
which one location will be used for a particular request.

In the above location{} blocks, you give no indication of what nginx  
should do with the request, so it uses its default of “serve it from  
the filesystem”.

The difference between your two observations is that in the first case,  
the location{} block is used for the request that you made; and in the  
second case, the location{} block is not used.

To fix your configuration, you must put all of the configuration that  
you want to apply to a request, in the one location{} that handles  
that request.

## f

Francis D. removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Peleke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a88e57/32.png) [@Peleke](https://www.ruby-forum.com/u/Peleke)\
**Post date:** [July 21, 2013, 7:09pm UTC](https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869/3 "2013-07-21T19:09:03Z")

</div>

Okay, it works if I add this:

```
location ^~ /folder1/admin {
    auth_basic "Login";
    auth_basic_user_file

```

/var/www/domain.tld/www/folder1/admin/.htpasswd;  
location ~ .php$ {  
#limit\_req zone=limit burst=5 nodelay;  
try\_files $uri =404;  
#fastcgi\_pass unix:/var/run/php5-fpm.sock;  
fastcgi\_pass 127.0.0.1:9000;  
fastcgi\_index index.php;  
fastcgi\_intercept\_errors off;  
fastcgi\_read\_timeout 120;  
fastcgi\_buffers 256 4k;  
fastcgi\_param SCRIPT\_FILENAME  
$document\_root$fastcgi\_script\_name;  
include /etc/nginx/fastcgi\_params;  
}  
}

```
##
# Pass PHP-Files To Socket
##

location ~ \.php$ {
    #limit_req zone=limit burst=5 nodelay;
    try_files $uri =404;
    #fastcgi_pass unix:/var/run/php5-fpm.sock;
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_intercept_errors off;
    fastcgi_read_timeout 120;
    fastcgi_buffers 256 4k;
    fastcgi_param SCRIPT_FILENAME 

```

$document\_root$fastcgi\_script\_name;  
include /etc/nginx/fastcgi\_params;  
}

But that is redundancy and can be complicated if you have many of those  
entries and then want to change a .php setting (you have to do it  
multiple  
times).  
Isn’t it possible to make it simpler?

Posted at Nginx Forum:

> **[Re: Location recursive downloads php files](https://forum.nginx.org/read.php?2,241080,241094#msg-241094)**
>
> I try to secure a specific folder and all files and subfolders with this location block: location ^~ /folder1/admin { auth\_basic "Login"; auth\_basic\_user\_file /var/www/domain.tld/www/folder1/admin/.htpasswd; } Wit

---

<div class="post-metadata">

**Author:** ![Peleke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a88e57/32.png) [@Peleke](https://www.ruby-forum.com/u/Peleke)\
**Post date:** [July 21, 2013, 10:17pm UTC](https://www.ruby-forum.com/t/location-recursive-downloads-php-files/235869/4 "2013-07-21T22:17:08Z")

</div>

On Sun, Jul 21, 2013 at 01:08:18PM -0400, Peleke wrote:

Hi there,

> Okay, it works if I add this:
> 
> ```
> location ^~ /folder1/admin {
> 
> ```

\> location ~ \.php$ { \> } \> }

> ```
> location ~ \.php$ {
> 
> ```

\> }

> But that is redundancy and can be complicated if you have many of those  
> entries and then want to change a .php setting (you have to do it multiple  
> times).  
> Isn’t it possible to make it simpler?

Yes.

Either use an external-to-nginx thing to create the complicated config  
file from less complicated parts; or put the repeated parts in a file  
and  
“include” it.

[http://nginx.org/r/include](http://nginx.org/r/include)

## f

Francis D. removed\_email\_address@domain.invalid