Nginx still serving static files although website access is blocked

Question

I have nginx installed on my centos server. I have blocked all external access to a test website I am working on. With this code.

location / {
    auth_basic "Administrator Login";
    auth_basic_user_file /home/config-files/.htpasswd;
}

The problem is it's not blocking access to static files. I can still access files like this.

wp-admin/images/icons32-vs-2x.png
wp-admin/css/colors/midnight/colors.min.css
wp-content/themes/testtheme/style.css

Why Nginx is not blocing access to these files.

EDIT Here is full virtual host file.

server {

    listen 80;
    server_name www.domainname.com;

    root /home/myuser/domainname.com/public;
    index index.html index.php;

    access_log /home/myuser/domainname.com/logs/access.log;
    error_log /home/myuser/domainname.com/logs/error.log;

    location ~ /\.svn/* {
        deny all;
    }

    location ~ \.(htaccess|htpasswd) {
        deny all;
    }

    location ~ \.conf$ {
        deny all;
    }

    location / {
        try_files $uri $uri/ /index.php?$args;
        auth_basic "Administrator Login";
        auth_basic_user_file /home/config-files/.htpasswd;
    }

    location ~ \.(css|js) {
        rewrite ^(.*/?)([a-z]+)-([0-9]+)\.(css|js)$ /$1$2.$4 last;
    }

    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    location ~* \.(js|css)$ {
        expires 30d;
        log_not_found off;
    }

    location ~* \.(?:ico|gif|jpe?g|png|svg)$ {
        expires 180d;
        add_header Pragma public;
        add_header Cache-Control "public";
        log_not_found off;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$; #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
        include fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass 127.0.0.1:9000;
    }

    rewrite ^(.*)/undefined$ /$1 permanent;
    rewrite ^(.*)/undefined/$ /$1 permanent;

}

Answer 1

nginx is matching 'location' sections not by order but by most-specific, read here. It is then applying only the best-matching location section to the request, and none of the others. Therefore, "location /" will only act on requests that are not matched by any of the other location sections (all of them being more specific).

Try to put the auth directives outside any location bracket, straight into server{}.