No authentication prompt with if block

Grant emailgrant at gmail.com
Sat Feb 8 16:43:53 UTC 2014


>> Authentication works fine if I don't include the if block but I'd like
>> to allow only a certain user access to this server block.  I get a 403
>> in the browser without any prompt for authentication.
>>
>> auth_basic "Authentication Required";
>> auth_basic_user_file htpasswd;
>> if ($remote_user != "myuser") {
>>     return 403;
>> }
>>
>> What am I doing wrong?
>
> Rewrite directives, including "if", are executed before access
> checks (and hence auth_basic).  So in your cofiguration 403 is
> returned before auth_basic has a chance to ask for authentication
> by returning 401.
>
> Something like
>
>    map $remote_user $invalid_user {
>        default      1;
>        ""           0;
>        "myuser"     0;
>    }
>
>    if ($invalid_user) {
>        return 403;
>    }
>
>    auth_basic ...
>
> should work, as it will allow empty $remote_user and auth_basic
> will be able to ask for authentication if credentials wasn't
> supplied.

That works great, thank you.  Does adding 'map' slow the server down much?

- Grant



More information about the nginx mailing list