Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up basic auth on a subfolder with nginx.

location ^~ /Docs/ {
   auth_basic            "Restricted Area";
   auth_basic_user_file  /var/www/Docs/.htpasswd; //also tried the path in quotes
}

I have tried numerous methods to generate a password (e.g apache's htpasswd) but I am not able to log in at /Docs with the username and password specified in .htpasswd. I see the authentication dialog with 'Restricted Area' but the password is not accepted.

I've tried the methods here:

share|improve this question
    
Have you looked in Nginx error logs for any messages? –  Mxx Apr 15 at 15:20
    
@Mxx D'oh forgot to do that. I can see lots of '5308#0: *17714 no user/password was provided for basic authentication' –  codecowboy Apr 15 at 15:26
1  
Try this as your .htpasswd file qqq:$apr1$n8K8x5Ff$8SmG1.VuQ6/Zm/LF2NFkX1 both username and password are "qqq" –  Mxx Apr 15 at 15:39
    
@Mxx tried that got the same error 'no user/password was provided for basic authentication' –  codecowboy Apr 16 at 7:48
    
However, I think that error may be normal for the initial request to the url which doesn't include the user/pass i.e before the auth dialog pops up. –  codecowboy Apr 16 at 7:54

2 Answers 2

Have you tried using an absolute location path?

location /Docs { auth_basic "Restricted Area"; auth_basic_user_file /var/www/Docs/.htpasswd; }

If that gets you further along, you may want to either (A) move the password file outside of the web root directory, or (B) protect the password file from being served:

location ~ /\. { deny all; }

And are you sure the file you have created is readable by the user nginx is running as?

share|improve this answer
    
yep, have tried this. Nginx runs as www-data on Ubuntu AFAIK. I have tried chown'ing everything to www-data:www-data. That dot file rule already exists in server {} –  codecowboy Apr 16 at 14:14

Turns out this was caused by a Squid caching proxy which was not passing authentication headers correctly. This was proved by running something similar to the following:

curl -i --user qqq:qqq http://target.server/Docs/dump.php |grep AUTH 

where dump.php contains <php phpinfo();

In the case of the server behind squid, the output of that command was empty and I would expect to see mention of _SERVER["HTTP_AUTHORIZATION"]

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.