Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to setup a password protected directory in a SSL website as follows:


server {
    listen 443:
    ssl on;
    ssl_certificate /usr/certs/server.crt;
    ssl_certificate_key /usr/certs/server.key;


    root /var/www/;
    index index.html;

    location /secure/ {
        auth_basic "Restricted";
        auth_basic_user_file /var/www/;

The problem is when I try to access the URL, I get a "404: Not Found" error page.

My error.log shows the following error:

011/11/26 03:09:06 [error] 10913#0: *1 no user/password was provided for basic authentication,
client:, server:, request: "GET /secure/ HTTP/1.1",
host: ""

However, I was able to setup password protected directories for a normal HTTP virtual host without any problems.

Is it a problem with the config or something else?

share|improve this question
Sure, auth_basic module works fine over https. I don't see the error_log directive in your server block. Where did you get the above error? I would suggest you tuning error_log to debug level to see what does it say. Did you clear cache or try with different browser? – quanta Nov 26 '11 at 10:21

Possibly it's a path problem for auth_basic_user_file, where your absolute path is confusing nginx:

Since version 0.6.7 the filename path is relative to directory of nginx configuration file nginx.conf, but not to nginx prefix directory.

I'm not sure how you have it working in the other cases. The quote from the documentation suggests that you should have to have something like:

auth_basic_user_file htpasswd/

where you'd have the password file as "/etc/nginx/htpasswd/" if you have "/etc/nginx/nginx.conf" as your server configuration file.

You can check nginx configuration by running "sudo nginx -t". If there's a configuration error, i.e., the auth file is not where it expects it to be, it should tell you at that point.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.