my config nginx.conf

location /database/ {
root /var/www/vhost/mysite.com/htdocs/database;
index index.php index.html index.htm;
allow xxx.xxx.xxx.xxx;
allow yyy.yyy.yyy.yyy;
deny all;
}

when restart nginx with config.
any ip can open http://mysite.com/database/index.php

my nginx.config is wrong or true .

or nginx bug ?

please help me.