Hi,

I'm using nginx to reverse-proxy a web app written in Javascript. For access control, I'm using the deny directive to deny users from accessing the menu items under the system menu; however, it does not deny it at the first time it loads but only at reloading. Can someone please help?

The config is as followed:
location ^~ /system/ {
deny all;
}

And the testcase is as followed:
1) Use a browser to go to '/'
2) Click on the "System" menu and click "Overview", and it will load '/system/overview' with no denial (should 403 instead)
3) Hit the reload button
4) It shows 403 this time