# Password protection and fastcgi

**URL:** <https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061>\
**Category:** NGINX\
**Created:** [December 20, 2011, 10:43pm UTC](https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061 "2011-12-20T22:43:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [December 20, 2011, 10:43pm UTC](https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061/1 "2011-12-20T22:43:42Z")

</div>

Hello,

i have a problem with a password protected folder and fastcgi php:  
server {  
root /foo/;  
…  
location ~ .php$ {  
fastcgi\_pass foo;  
include fastcgi\_parms;  
}  
location ^~ /passwordprotected {  
auth\_basic “foo”;  
auth\_basic\_user\_file foo;  
}  
}

The protection works fine, but php don’t work. Then i added the  
fastcgi\_pass part to my new location, but then images will be parsed  
too.

What’s the right way to protect folders?

Thanks

Posted at Nginx Forum:

> **[Password protection and fastcgi](https://forum.nginx.org/read.php?2,220335,220335#msg-220335)**
>
> Hello, i have a problem with a password protected folder and fastcgi php: server { root /foo/; ... location ~ \\.php$ { fastcgi\_pass foo; include fastcgi\_parms; } location ^~ /passwordprotected { auth\_

---

<div class="post-metadata">

**Author:** ![Veerle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/c89c15/32.png) [@Veerle](https://www.ruby-forum.com/u/Veerle)\
**Post date:** [December 21, 2011, 3:57am UTC](https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061/2 "2011-12-21T03:57:24Z")

</div>

The right way is to add the auth basic directives to the PHP location as  
nginx will only ever execute one location. So in your pasted config, if  
nginx gets a request for /passwordprotected/index.php then it won’t be  
protected.

Of course, if you only want PHP files in that directory to be protected  
then you need a 2nd PHP location.

Posted at Nginx Forum:

> **[Re: Password protection and fastcgi](https://forum.nginx.org/read.php?2,220335,220336#msg-220336)**
>
> Hello, i have a problem with a password protected folder and fastcgi php: server { root /foo/; ... location ~ \\.php$ { fastcgi\_pass foo; include fastcgi\_parms; } location ^~ /passwordprotected { auth\_

---

<div class="post-metadata">

**Author:** ![Veerle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/c89c15/32.png) [@Veerle](https://www.ruby-forum.com/u/Veerle)\
**Post date:** [December 21, 2011, 2:48pm UTC](https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061/3 "2011-12-21T14:48:02Z")

</div>

## Ensiferous Wrote:

> The right way is to add the auth basic directives  
> to the PHP location as nginx will only ever  
> execute one location. So in your pasted config, if  
> nginx gets a request for  
> /passwordprotected/index.php then it won’t be  
> protected.

Thanks,

how can i add them to the same direction? I don’t want to protect all  
files, ionly files in the specific folder.  
Something like that don’t work:

server {  
root /foo/;  
…  
location ~ .php$ {  
fastcgi\_pass foo;  
include fastcgi\_parms;

location ^~ /passwordprotected {  
auth\_basic “foo”;  
auth\_basic\_user\_file foo;  
}

}

}

Thanks

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,220335,220357#msg-220357](http://forum.nginx.org/read.php?2,220335,220357#msg-220357)

---

<div class="post-metadata">

**Author:** ![Veerle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/c89c15/32.png) [@Veerle](https://www.ruby-forum.com/u/Veerle)\
**Post date:** [December 21, 2011, 3:11pm UTC](https://www.ruby-forum.com/t/password-protection-and-fastcgi/215061/4 "2011-12-21T15:11:34Z")

</div>

On Wednesday 21 December 2011 17:47:43 Veerle wrote:

> Thanks,  
> include fastcgi\_parms;
> 
> location ^~ /passwordprotected {  
> auth\_basic “foo”;  
> auth\_basic\_user\_file foo;  
> }
> 
> }
> 
> }

location ^~ /passwordprotected {  
auth\_basic “foo”;  
auth\_basic\_user\_file foo;

```
  location ~ \.php$ {
      fastcgi_pass foo;
      include fastcgi_parms;
  }

```

}

wbr, Valentin V. Bartenev