# Location regex + if + basic auth to restrict directory access

**URL:** <https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024>\
**Category:** NGINX\
**Created:** [February 28, 2013, 11:38pm UTC](https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024 "2013-02-28T23:38:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [February 28, 2013, 11:38pm UTC](https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024/1 "2013-02-28T23:38:19Z")

</div>

Hello,

I am using basic auth + $remote\_user variable send to the back-end  
application to change context depending on the logged-in user.

The thing is, even if the page rendered by the back-end uses nginx user  
authentication, resources from a directory are still allowed for  
everyone.

My ‘documents’ directory is sorted as follows:  
documents/  
abc/ --\> stores content for user ‘abc’  
def/ --\> stores content for user ‘def’  
…

I tried the following:  
location ^~ /documents/(\w+) {  
if ($1 != $remote\_user) {  
return 503;  
}  
}

But Nginx refuses to validate configuration:  
nginx: [emerg] unknown “1” variable  
nginx: configuration file /etc/nginx/nginx.conf test failed

Does the ‘if’ directive have an environment isolated for the on of the  
‘location’ directive?  
Am I using wrong syntax?  
Is there a ‘IfIsEvil’ case corresponding to my needs to avoid the use of  
the ‘if’ directive?

## Thanks,

_B. R._

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 10, 2013, 10:30am UTC](https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024/2 "2013-03-10T10:30:30Z")

</div>

I’ll answer to my own question there:

Apparently, yes, evaluating something with the ‘if’ directive doesn’t  
propagate the environment containing the variables from the ‘location’  
directive.  
All explained on  
StackOverflow[http://stackoverflow.com/questions/10876252/nginx-given-custom-subdomain-location-regex-matching-with-http-user-agent-con](http://stackoverflow.com/questions/10876252/nginx-given-custom-subdomain-location-regex-matching-with-http-user-agent-con)  
.

The _incorrect_ way:

location ^~ /documents/(\w+) {  
if ($1 != $remote\_user) {  
return 503;  
}  
}  
 _→ $1 variable is unknown_

The _correct_ way:  
location ^~ /documents/(\w+) {  
set $user $1;  
if ($user != $remote\_user) {  
return 503;  
}  
}

Although the syntax is now OK and the configuration is able to be  
reloaded,  
it doesn’t seem to work at all…

When connecting with the user ‘abc’, I am still able to access  
/documents/def/mydoc.txt.  
What’s wrong with my way of restricting access?

## Thanks for any help,

_B. R._

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 10, 2013, 11:47am UTC](https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024/3 "2013-03-10T11:47:37Z")

</div>

On Sun, Mar 10, 2013 at 05:29:18AM -0400, B.R. wrote:

Hi there,

> The _correct_ way:  
> location ^~ /documents/(\w+) {  
> set $user $1;  
> if ($user != $remote\_user) {  
> return 503;  
> }  
> }
> 
> Although the syntax is now OK and the configuration is able to be reloaded,  
> it doesn’t seem to work at all…

I haven’t tested the “if” part; but in this case it’s mostly likely that  
this location{} block is not being used at all.

Your configuration is syntactically correct, so nginx can load it.

But it is not semantically correct, as in “it does not mean what you  
want  
it to mean”.

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#location)**
>
> This directive appeared in version 1.11.8.

“^~” does not mean “this is a regex location”

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 10, 2013, 8:16pm UTC](https://www.ruby-forum.com/t/location-regex-if-basic-auth-to-restrict-directory-access/227024/4 "2013-03-10T20:16:28Z")

</div>

Hello,

Thanks for that… I thought the ^~ was meaning ‘starting with regex’…  
My bad!

I changed the symbol for some of the ones relly meaning ‘regex’ (~\*)  
and it works! :o)

If there is no better way than sticking with  
‘if’, then it’s all good.

## Thanks again, problem solved,

_B. R._