1

There is the URL /index.php. Access to it should be restricted, if it has argument ‘foo’ set to, say, ‘bar’, i.e. /index.php should open freely by anyone, and opening /index.php?foo=bar should proceed only after basic authorisation. I know about the if directive,

location = index.php {
    if ($arg_foo ~ bar) {
        auth_basic "";
        auth_basic_user_file myauth;  
    }
    fastcgi_pass unix:/var/run/php-fpm.socket;
}

…but a separate location with if doesn’t allow auth_basic to be put inside of an if clause. So I thought there should be some kind of rewrite to another location, probably passing a header containing the original location we wanted to get to, check the header and after passing the authentication, rewrite to that location, but this all looks like too much of a hack and probably can be done easier, but I don’t know how.

1 Answer 1

0

I suggest you use map, since auth_basic has a special off value disabling authentication:

http {
    [...]
    map $arg_foo $auth_realm {
        default off;
        ~bar    "";
    }

    server {
        [...]
        location = /index.php {
            auth_basic $auth_realm;
            auth_basic_user_file myauth;

            fastcgi_pass unix:/var/run/php-fpm.socket;
        }
    }
}

Note: I suspect the configuration snippet you provided is not working, since the URI prefix of the location directive does not start with the mandatory / character.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .