Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up basic auth on a subfolder with nginx.

location ^~ /Docs/ {
   auth_basic            "Restricted Area";
   auth_basic_user_file  /var/www/Docs/.htpasswd; //also tried the path in quotes

I have tried numerous methods to generate a password (e.g apache's htpasswd) but I am not able to log in at /Docs with the username and password specified in .htpasswd. I see the authentication dialog with 'Restricted Area' but the password is not accepted.

I've tried the methods here:

share|improve this question
Have you looked in Nginx error logs for any messages? – Mxx Apr 15 '14 at 15:20
@Mxx D'oh forgot to do that. I can see lots of '5308#0: *17714 no user/password was provided for basic authentication' – codecowboy Apr 15 '14 at 15:26
Try this as your .htpasswd file qqq:$apr1$n8K8x5Ff$8SmG1.VuQ6/Zm/LF2NFkX1 both username and password are "qqq" – Mxx Apr 15 '14 at 15:39
@Mxx tried that got the same error 'no user/password was provided for basic authentication' – codecowboy Apr 16 '14 at 7:48
However, I think that error may be normal for the initial request to the url which doesn't include the user/pass i.e before the auth dialog pops up. – codecowboy Apr 16 '14 at 7:54

Have you tried using an absolute location path?

location /Docs { auth_basic "Restricted Area"; auth_basic_user_file /var/www/Docs/.htpasswd; }

If that gets you further along, you may want to either (A) move the password file outside of the web root directory, or (B) protect the password file from being served:

location ~ /\. { deny all; }

And are you sure the file you have created is readable by the user nginx is running as?

share|improve this answer
yep, have tried this. Nginx runs as www-data on Ubuntu AFAIK. I have tried chown'ing everything to www-data:www-data. That dot file rule already exists in server {} – codecowboy Apr 16 '14 at 14:14
up vote 1 down vote accepted

Turns out this was caused by a Squid caching proxy which was not passing authentication headers correctly. This was proved by running something similar to the following:

curl -i --user qqq:qqq http://target.server/Docs/dump.php |grep AUTH 

where dump.php contains <php phpinfo();

In the case of the server behind squid, the output of that command was empty and I would expect to see mention of _SERVER["HTTP_AUTHORIZATION"]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.