Nginx: How to exclude a URL with a query parameter from htpasswd authorization

Question

A wordpress site has its /wp-login.php protected with HTTP authorization using htpasswd. Web server is Nginx. Config for the same is given below.

A URL associated with a plugin uses wp-login.php?query-parameters to manage enternal users. Example of the URL is:
http://beta.timepass.com/wp-login.php?action=wordpress_social_authenticate&mode=login&provider=Facebook

I need to allow only those URLs that match the query parameter action=wordpress_social_authenticate to bypass htpasswd. I have tried a few things, but getting nowhere! Nginx doesn't take auth_basic "off" in its if-condition.

Nginx config for reference :

server {
  listen 80;
  server_name beta.timepass.com;
  root /var/www/projects/beta.timepass.com;
  index index.php index.html index.htm;
  autoindex off;
  access_log /var/log/nginx/beta.timepass.com-access.log;
  error_log /var/log/nginx/beta.timepass.com-error.log;


  try_files $uri $uri/ /index.php?$args;


## Disallow direct access to wp-login.php
    location ~* ^/wp-login.php {
        #satisfy any;
        #allow 192.168.1.0/24;
        allow 192.168.1.157;
        auth_basic "Site Needs You to Authenticate";
        auth_basic_user_file /etc/nginx/htpass-beta ;

        fastcgi_pass 127.0.0.1:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  location ~ \.php$ {
    expires off; ## Do not cache dynamic content
    #add_header Pragma public;
    #add_header Cache-Control "public, max-age=300";

    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME /var/www/projects/beta.timepass.com$fastcgi_script_name;
    fastcgi_read_timeout 60s;
  }

}

Answer 1

You should use a map for this since the auth_basic directive permits variables usage.

For instance :

map $arg_action $auth {
     default "Site Needs You to Authenticate";
     "wordpress_social_authenticate" "off";
}


server {

    [...]

    location ~* ^/wp-login.php {

        auth_basic $auth;
        auth_basic_user_file /etc/nginx/htpass-beta ;

        [ ...]

    }

}