With standard configuration settings:

location /dload {
auth_basic "protected download";
auth_basic_user_file /var/www/ap.hk.lo/.dload;
}


i can access files in directory /dload without authentification.
I get normal server response for GET /dload (header WWW-Authenticate Basic realm="protected download")
but i get 200 OK header for any request inside /dload directory.
Is it bug of nginx?
What configuration should i use?