9

i want to protect a folder of my website with a password using auth_basic. This folder contains php-scripts which should be executed if they are requested.

I tried the following:

location /admin {
  auth_basic    "Admin-Section";
  auth_basic_user_file /myfolder/.htpasswd;
 }

 location ~ ^/admin/.*\.php$ {
  auth_basic    "Admin-Section";
  auth_basic_user_file /myfolder/.htpasswd;
  fastcgi_pass 127.0.0.1:9000;
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
  include   fastcgi_params;
 }

I will be asked for username/password when requesting the php-scripts in that admin-folder, but the php-scripts will always be downloaded instead of executed via fastcgi.

What am i doing wrong?

EDIT: On my local machine everything works fine with this configuration. o0
EDIT: BTW, php is working outside the admin-folder with the same fastcgi-options.
EDIT: OMG! The site's config was stored at /etc/nginx/sites-available/mysite and /etc/nginx/sites-enabled/ contained a symlink to the mysite-file. Since some time changing the mysite-file had no effect. E.g. changing all locations to "deny all" had no effect. The files were sent without a problem.
So i removed the symlink and restarted the server. Then i created the symlink again, restarted the server and everything works as expected. Can someone explain the odd behaviour?

Gest regards,
Biggie

4 Answers 4

15

With this configuration, nginx will only match one of the two blocks - the one with the highest precedence.

The solution is to combine the PHP block into the AUTH block. This is the approach recommended by the nginx author himself, Igor Sysoev.

location /admin/ {
  auth_basic    "Admin-Section";
  auth_basic_user_file /myfolder/.htpasswd;
  location ~ \.php$ {
   fastcgi_pass  127.0.0.1:9000;
   fastcgi_index index.php;
   fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
   include       fastcgi_params;
  }
}

location ~ \.php$ {
  fastcgi_pass  127.0.0.1:9000;
  fastcgi_index index.php;
  fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
  include       fastcgi_params;
}
3
  • 1
    is there any way to avoid the obvious code duplication?
    – peedee
    Oct 24, 2016 at 8:11
  • Put the duplicated code in a separate file and include it from each block. Dec 4, 2016 at 8:05
  • 1
    I understand that this is how nginx works, but this has bitten me so many times that it's not funny anymore. I literally need to re-include everything in every location block where I want to change some behavior. This is really painful, even when using a large amount of snippet files. One little mistake and some auth_basic or deny directives might fail to apply in unexpected ways (since regex matches may take precedence over prefix matches). Very error-prone.
    – jlh
    May 6, 2020 at 7:51
1

This is an old question, but I just had the same problem, so here's the explanation.

Nginx uses the rules described in the docs to match the location blocks. For conventional blocks, the longest match will be the one that will be applied, but for regular expressions it's always the first matching block that will be applied.

In your production server, you most likely had a location ~ \.php$ block above your admin block, hence the listen block you posted was never applied.

Long short story: when dealing with regular expression listen blocks in nginx, order matters. Put the more specific matches before the general ones.

-1

You need to remove the following line:

fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
1
  • 3
    That's a necessary line when php-fpm is running in a chroot jail.
    – Zenexer
    Aug 22, 2013 at 8:34
-1

Maybe you forgot to add root:

location ~ .\php$ {
    #Lines of code...
    root /your/document/root;
    #Lines of code...
}

location /admin/ {
    #Lines of code...
    root /your/document/root;
    #Lines of code...
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.