I run SugarCRM on a LEMP stack and have it closed down with auth_basic. That works fine, headers show:

Basic realm="Username and Password are required"

Some files within SugarCRM have their own built in http auth through PHP, for example ical_server.php which shows in its headers:

Basic realm="SugarCRM iCal"
PHP class: HTTP_WebDAV_Server_iCal

I am attempting to bypass auth_basic for this file, or at least my own realm, the first one shown above.

location = /ical_server.php {
       auth_basic "off";

However, this switches off both realms. In other words, it switches off auth_basic altogether, indiscriminately.

Is there a way to selectively switch off a http basic authentication realm of choice? The Nginx documentation seems to suggest there isn't, if that's true, then is there another, perhaps roundabout way to accomplish this?

Such as a regex for switching on my realm in the first place?


location != /ical_server.php {
auth_basic "Username and Password are required";
auth_basic_user_file /var/web/webaddress.tld/private/.htpasswd;


Though I don't think negative matching is possible.

Any ideas?

1 Answer 1


You may define two locations :

location /ical_server.php {

location / {
        auth_basic "Username and Password are required";
        auth_basic_user_file /var/web/webaddress.tld/private/.htpasswd;
  • Thank you, it was indeed as straight-forward as that. It keeps boggling my mind when Nginx takes the first matching location and when it takes the last, or any other in between, to execute.
    – JayMcTee
    Apr 16, 2015 at 13:09
  • I'm still on the case (; Nginx seems to select the first location that match with the request and does not compute anything else.
    – Eric Ly
    Apr 16, 2015 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.