Question

Deny access to directory, allow access to files NGINX

I’m trying to put my directories behind a htpasswd file, but allow any user to access the files in said directory.

So far I have this


location ~ ^/files\/.*(?=\.)$  {
  auth_basic            "Restricted";
  auth_basic_user_file  /media/sdh1/home/qwertyspace/www/qwertyspace.zeus/public_html/files/.htpasswd;
  autoindex on;
}

#allow retrieval of any individual image via URL without auth
location ~* \..*$ {
  autoindex off;
}

Based off this: https://serverfault.com/questions/574348/how-can-i-password-protect-a-directory-with-nginx-but-not-the-files-within-the

But it still asks for a password when trying to download a file.

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

alexdo • December 27, 2019

Hello, @QwertySpace

I’ve noticed that another community user have asked the same question and he was able to achieve this in this posted question:

https://www.digitalocean.com/community/questions/how-to-restrict-multiple-directories-with-nginx-but-still-access-files

In my case, I wanted to restricted people from wondering around my server just by typing the www.exemple.com/test1/test2 and be able to see what is inside it without specifying the direct link to it example: www.exemple.com/test1/test2/image1.png

There is a command also that is important that sets a priority of file searching;

location / { try_files $uri $uri/ =404; }

This command means it will try to access the file 1st then the folder then give you an error 404 if nothing works. More info: http://stackoverflow.com/questions/17798457/how-can-i-make-this-try-files-directive-work

Hope this helps.

Regards, Alex

alexdo • December 17, 2019

Hello, @QwertySpace

You should be able to set this using:

auth_basic "Admin Access";

instead of:

auth_basic "Restricted";
location ~* \..*$ {
autoindex off;

Hope this helps,

Let me know how it goes.

Regards, Alex