Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured nginx to password protect a directory using auth_basic. The password prompt comes up and the login works fine.

However... if I refuse to type in my credentials, and instead hit escape multiple times in a row, the page will eventually load w/o CSS and images.

In other words, continuously telling the login prompt to go away will at some point allow the page to load anyway.

Is this an issue with nginx, or my configuration?

Here is my virtual host:

31 server {
32    server_name;
33    root /www/;
35    location / {
36        index index.php index.html;
37        root /www/;
38        auth_basic  "Restricted";
39        auth_basic_user_file /www/auth/;
40        error_page 404 = /www/404.php;
41    }
43    location ~ \.php$ {
44        include /usr/local/nginx/conf/fastcgi_params;
45     }
46 }

My server runs CentOS + nginx + php-fpm + xcache + mysql

share|improve this question
up vote 4 down vote accepted

Your configuration, nginx will use only the most specific location block. So when you request a *.php file it will use the location ~ .php$ block and not see the auth basic configuration.

The reason your .css, .js etc files work is because these do not match the PHP location block

You will need to add your auth basic configuration to the php file location block as well.

share|improve this answer
Or just move it to server block, not location – ghloogh Dec 27 '12 at 6:10
If you want it to block everything for that domain then yes, move it to the server block. – Martin Fjordvald Dec 28 '12 at 5:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.