Hello!
On Fri, Oct 13, 2017 at 12:47:11AM -0500, Stian Øvrevåge wrote:
> Hi list,
>
> I have a server {} block that is protected with auth_request; on the top
> level.
>
> auth_request is used for a interactive login process.
>
> I have some endpoints that will receive data from other software, and
> must instead be protected by auth_basic. However, "auth_request off;"
> is ignored in these location{} blocks IF there is also a auth_basic
> statement in the block.
>
> This works without logging in:
> location /test/ {
> auth_request off;
> proxy_pass http://localhost:88/;
> }
>
> This is automatically redirected back to /security/ for login (as
> defined by auth_request in server{} block.
> location /api/ {
> auth_request "off";
> auth_basic "Restricted access";
> auth_basic_user_file /etc/htpasswd;
> proxy_pass http://localhost:88/;
> }
>
> I see online references to a "satisfy any" directive that apparently
> worked a few years ago, but it does not anymore, and others are
> reporting similar problems:
> https://stackoverflow.com/questions/42301559/nginx-with-auth-request-and-auth-basic
Works fine here:
$ curl http://127.0.0.1:8080/
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.13.7</center>
</body>
</html>
$ curl http://127.0.0.1:8080/test/
ok
$ curl http://127.0.0.1:8080/api/
<html>
<head><title>401 Authorization Required</title></head>
<body bgcolor="white">
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.13.7</center>
</body>
</html>
$ curl --basic --user foo:foo http://127.0.0.1:8080/api/
ok
Just tested with the following configuration:
server {
listen 8080
auth_request /auth;
location / {
proxy_pass http://localhost:8082;
}
location /test/ {
auth_request off;
proxy_pass http://localhost:8082;
}
location /api/ {
auth_request "off";
auth_basic "Restricted access";
auth_basic_user_file /path/to/htpasswd;
proxy_pass http://localhost:8082;
}
location = /auth {
return 403;
}
}
server {
listen 8082;
return 200 ok\n;
}
Note that in the request to /api/, where auth_basic is configured,
you have to request specify username and password, or the request
will be rejected by auth_basic.
--
Maxim Dounin
http://nginx.org/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
