NGINX auth_basic exclude GET request to specific php script

droplet

11/8/22, 4:48 PM

I can't seem to figure out how to exclude a specific location from auth_basic.

server {
        server_name example.com;

        root /var/www/html;

        index index.php;

        auth_basic "Nein nein nein";
        auth_basic_user_file .htpasswd;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        }

        # this script needs free access and takes query string parameters
        location /sub/script.php {
                auth_basic off;
        }

        # this works fine
        location /sub/a-javascript.js {
                auth_basic off;
        }
...

The location /sub/script.php needs free access. It would also be nice if it could only allow GET request to it. My problem seems to be the query parameters that come after it.

The script gets always requested with many query parameters script.php?param=something&other_param=somethingelse&etc=etc

239

1 + 6

nginx

php-fpm

authorization

Paul

11/8/22, 8:28 PM

I'm not clear why `location ~ /sub/script\.php$ { auth_basic off; include snippets/fastcgi-php.conf; fastcgi_pass unix:/var/run/php/php7.4-fpm.sock; limit_except GET { deny all; } }`, but I haven't used those before.

Pothi Kalimuthu

11/9/22, 5:22 AM

Paul is right. Please know that using limit_except to allow GET also allows HEAD requests.

droplet

11/9/22, 12:32 PM

@Paul still getting 401'd

Paul

11/9/22, 1:56 PM

Is there anything more in the logs? Does setting `error_log debug;` give anything more?

Paul

11/9/22, 2:06 PM

Oh, also try moving the `location ~ /sub/script\.php$...` block to be above the `location ~ \.php$...` block, if you haven't already.

droplet

11/9/22, 3:43 PM

@Paul Yeah, it seems moving it above the php block did the trick. Thanks!

Score:1

Server

Paul

11/9/22, 4:43 PM

You current configuration is matching requests for /sub/script\.php$ on the following location block:

        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        }

Use the following configuration which places the /sub/script\.php$ location above the \.php$ location because nginx will stop evaluating at the first matched regex location.

server {
        server_name example.com;

        root /var/www/html;

        index index.php;

        auth_basic "Nein nein nein";
        auth_basic_user_file .htpasswd;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ /sub/script\.php$ {
                auth_basic off;
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
                limit_except GET { deny all; } # Also allows HEAD
                }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
        }

        # this works fine
        location /sub/a-javascript.js {
                auth_basic off;
        }
...

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: NGINX auth_basic exclude GET request to specific php script

TH: NGINX auth_basic ไม่รวมคำขอ GET สำหรับสคริปต์ php เฉพาะ

RO: NGINX auth_basic exclude cererea GET la un anumit script PHP

RU: NGINX auth_basic исключает GET-запрос к определенному php-скрипту

VI: NGINX auth_basic loại trừ yêu cầu GET đối với tập lệnh php cụ thể

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.