# Nginx http auth module query

**URL:** <https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927>\
**Category:** NGINX\
**Created:** [February 17, 2012, 4:50am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927 "2012-02-17T04:50:12Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [February 17, 2012, 4:50am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/1 "2012-02-17T04:50:12Z")

</div>

Hi,

I have the following use case -

I have nginx running at port 80 and a php hiphop server running at 4247.  
I want to achieve the following configuration -

Whenever a request is received at nginx port 80, it should be sent to  
some auth\_url (say auth.php) and if it is authorized then it should be  
forwarded/proxied to hiphop server running at 4247. If not some error  
page should be thrown.

I was looking through ngx\_http\_auth\_request\_module and other inbuilt  
modules. But I have the following doubts -

1. What could the possible config look like where both  
ngx\_http\_auth\_request\_module and proxy\_pass are included?
2. For my auth.php, what should it return true/false or something else?

Thanks,  
Karan

Posted at Nginx Forum:

> **[nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222520#msg-222520)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 5:02am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/2 "2012-02-17T05:02:01Z")

</div>

On 17 Fev 2012 03h49 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> some error page should be thrown.  
> Karan  
> Schematically:

location /index.php {  
error\_page 401 403 /not\_authorized.html;  
auth\_request /auth.php;  
proxy\_pass [http://hiphop:4247](http://hiphop:4247);  
}

location = /auth.php {

# FCGI stuff or whatever PHP CGI you’re using.

# auth.php should return 401 or 403 when auth process fails, return

# 200 otherwise

}

— appa

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 5:08am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/3 "2012-02-17T05:08:53Z")

</div>

Thanks for the response.

For this -

location /index.php {  
error\_page 401 403 /not\_authorized.html;  
auth\_request /auth.php;  
proxy\_pass [http://hiphop:4247](http://hiphop:4247);  
}

Does it mean that auth.php should be available via the url -  
[http://hiphop:4247/auth.php](http://hiphop:4247/auth.php) ?

location = /auth.php {

# FCGI stuff or whatever PHP CGI you’re using.

# auth.php should return 401 or 403 when auth process fails, return

# 200 otherwise

}

Does it enter this section after it gets 2xx response from auth.php?

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,222520,222523#msg-222523](http://forum.nginx.org/read.php?2,222520,222523#msg-222523)

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 9:54am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/4 "2012-02-17T09:54:21Z")

</div>

Thanks it works !

Posted at Nginx Forum:

> **[Re: nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222535#msg-222535)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 9:58am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/5 "2012-02-17T09:58:04Z")

</div>

One additional question here -

In this as I understand it redirects to error\_page on receiving a 4xx  
status code. Is it possible that nginx reads the value of error page  
from a custom header which comes along with the response (with 4xx  
status code) and then assign the value of error\_page to that value.

Posted at Nginx Forum:

> **[Re: nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222536#msg-222536)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 12:26pm UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/6 "2012-02-17T12:26:50Z")

</div>

Hello!

On Fri, Feb 17, 2012 at 03:57:50AM -0500, karanj wrote:

> One additional question here -
> 
> In this as I understand it redirects to error\_page on receiving a 4xx  
> status code. Is it possible that nginx reads the value of error page  
> from a custom header which comes along with the response (with 4xx  
> status code) and then assign the value of error\_page to that value.

You may use use auth\_request\_set to make headers available as  
variables in main request.

See docs here:

[http://mdounin.ru/hg/ngx\_http\_auth\_request\_module/file/tip/README#l23](http://mdounin.ru/hg/ngx_http_auth_request_module/file/tip/README#l23)

Sample usage may be seen in tests here:

[http://mdounin.ru/hg/ngx\_http\_auth\_request\_module/file/tip/t/auth-request-set.t](http://mdounin.ru/hg/ngx_http_auth_request_module/file/tip/t/auth-request-set.t)

Maxim D.

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 2:31pm UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/7 "2012-02-17T14:31:12Z")

</div>

It doesn’t work for me.

I have 3 files running under HipHop -

1. /tf/test.php - This file sets the session variable -  
$\_SESSION[‘X-ErrorPage’]=‘/tf2/test.php’;  
and then sends header(“HTTP/1.1 401 Unauthorized”);
2. /tf2/test2.php - This prints “It works”
3. /tf2/test.php - This prints “Error Page”

My config looks like this -  
The output on running [http://112.11.23.221:8080/tf2/test2.php](http://112.11.23.221:8080/tf2/test2.php) should be

- “Error Page”. But this is not happening.

The nginx error logs shows the following -

2012/02/17 18:52:45 [error] 10103#0: \*4 the rewritten URI has a zero  
length, client: 122.179.93.88, server: 112.11.23.221, request: “GET  
/tf2/test2.php HTTP/1.1”, host: “112.11.23.221:8080”

server {  
listen 8080;  
server\_name 112.11.23.221;

```
    location / {
            auth_request /tf/test.php;
            proxy_pass http://127.0.0.1:4247;
            error_page 401 = /40x.html;
    }
    location /tf/test.php{
            proxy_pass http://127.0.0.1:4247;
    }

    location = /40x.html {
            auth_request_set $err $upstream_http_x_errorpage;
            rewrite /40x.html $err;
            proxy_pass http://127.0.0.1:4247;
    }
}

```

Posted at Nginx Forum:

> **[Re: nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222552#msg-222552)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 5:29am UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/8 "2012-02-17T05:29:33Z")

</div>

On 17 Fev 2012 04h08 WET, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Does it mean that auth.php should be available via the url -  
> [http://hiphop:4247/auth.php](http://hiphop:4247/auth.php) ?

You must create a location that overrides the “default” PHP  
handling location.

> location = /auth.php {
> 
> # FCGI stuff or whatever PHP CGI you’re using.
> 
> # auth.php should return 401 or 403 when auth process fails, return
> 
> # 200 otherwise
> 
> }

location = /auth.php {  
proxy\_pass\_request\_body off;  
proxy\_set\_header Content-Length ‘’;  
proxy\_set\_header X-Original-URI $request\_uri;  
proxy\_pass [http://hiphop:4247](http://hiphop:4247);  
}

Note that the auth\_request module only uses the headers. So your  
auth.php authorization script must take that into account.

> Does it enter this section after it gets 2xx response from auth.php?

When the /auth.php location returns 200 then the request is  
_authorized_ and the request is proxy passed to the hiphop upstream in  
the index.php location from the above example.

— appa

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 2:39pm UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/9 "2012-02-17T14:39:17Z")

</div>

One correction -  
/tf/test.php - This file sets the header - header(‘X-ErrorPage:  
/tf2/test.php’);  
and then sends header(“HTTP/1.1 401 Unauthorized”);

Posted at Nginx Forum:

> **[Re: nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222553#msg-222553)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 4:32pm UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/10 "2012-02-17T16:32:18Z")

</div>

That worked. Awesome and thanks a lot !

–  
Karan

Posted at Nginx Forum:

> **[Re: nginx http auth module query](https://forum.nginx.org/read.php?2,222520,222564#msg-222564)**
>
> Hi, I have the following use case - I have nginx running at port 80 and a php hiphop server running at 4247. I want to achieve the following configuration - Whenever a request is received at nginx port 80, it should be sent to some auth\_url (say...

---

<div class="post-metadata">

**Author:** ![karanj](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/9de0a6/32.png) [@karanj](https://www.ruby-forum.com/u/karanj)\
**Post date:** [February 17, 2012, 3:19pm UTC](https://www.ruby-forum.com/t/nginx-http-auth-module-query/216927/11 "2012-02-17T15:19:35Z")

</div>

Hello!

On Fri, Feb 17, 2012 at 08:30:33AM -0500, karanj wrote:

> The output on running [http://112.11.23.221:8080/tf2/test2.php](http://112.11.23.221:8080/tf2/test2.php) should be  
> server\_name 112.11.23.221;  
> location = /40x.html {  
> auth\_request\_set $err $upstream\_http\_x\_errorpage;  
> rewrite /40x.html $err;  
> proxy\_pass [http://127.0.0.1:4247](http://127.0.0.1:4247);  
> }  
> }

You have to use auth\_request\_set in the same location with  
auth\_request directive.

```
location / {
    auth_request /tf/test.php;
    auth_request_set $err $upstream_http_x_errorpage;
    ...
}

...

```

Maxim D.