Hello,

I notice a big bug (or is it me) using nginx/1.16.1 (on Arch) and auth_basic which don't protect the whole directory using a simple

location /admin {
auth_basic "Restricted";
auth_basic_user_file /srv/http/admin/.htpasswd;
}

When i go to admin/index.php i got a auth request. But, if i have a admin/test.php file, i can request the file without any auth request.

What am i doing wrong ?
Bye

https://www.digitalocean.com/community/tutorials/how-to-set-up-password-authentication-with-nginx-on-ubuntu-14-04

---
nginx for Windows http://nginx-win.ecsds.eu/

I try with same result

location /admin {
try_files $uri $uri/ =404;
auth_basic "Restricted";
auth_basic_user_file /srv/http/admin/.htpasswd;
}

Mind that i got auth request on admin/ not if i request a php file in it

See the bottom (comments) of that article, your php block looks like it is not a part of the main location block.

---
nginx for Windows http://nginx-win.ecsds.eu/

Thank you very much, i include a copy of the php block into the password protected one. all is ok thanks