3

I got nginx running on my server and recently installed Piwik with this config:

server {
  listen 443 ssl spdy;
  server_name analytics.example.org;
  root /srv/www/analytics.example.org;
  index index.php;

  ssl_certificate ssl-certificates/wildcard.example.org.crt;
  ssl_certificate_key ssl-certificates/wildcard.example.org.key;

  access_log           /var/log/nginx/analytics.example.org_access.log;
  error_log            /var/log/nginx/analytics.example.org_error.log;

  auth_basic           "HTTP Basic Authentication";
  auth_basic_user_file htpasswd/example;

  satisfy              any;
  include              example_ip;
  deny                 all;

  location ~*  \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires max;
  }

  location = /robots.txt {
    return 200 "User-agent: *\nDisallow: /\n";
  }

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ .php$ {
    try_files $uri $uri/index.php =404;
    include fastcgi.conf;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
  }

  location = /piwik.js {
    satisfy any;
    allow all;
    auth_basic off;
    try_files $uri =404;
  }
}

I'm trying to turn off basic auth for /piwik.js since it's requested from the app itself and it's always asking for username and password.

What am I doing wrong here?

--- Update 1 ---

Updated config:

...
location = /piwik.js {
  satisfy any;
  allow all;
  auth_basic off;
  try_files $uri =404;
}

location / {
  auth_basic           "Bitte authentifiziere dich.";
  auth_basic_user_file htpasswd/pass;

  satisfy              any;
  include              pass_ip;
  deny                 all;

  try_files $uri $uri/ /index.php?$args;
}
...

Now it let's me access piwik.js from the app and also asks for basic auth for analytics.example.org. However, when I click cancel, part of the website gets loaded, next basic auth, cancel, loading, etc.

--- Update 2 ---

I also added the basic auth stuff to the location ~ .php$ directive and it's working now, however having it in two places doesn't seem right. Anyway I can make it nicer?

Cojones
  • 123
  • 3
  • 9
  • I haven't played with `auth_basic`, but it's been on my list. But just to put up a guess, if you were to put your `auth_basic` directives under a location block, such as `location /`, then before the `location /` block, put your `location = /piwik.js` block, would that work? – Paul Apr 30 '15 at 22:03
  • Almost, see my updated question. – Cojones May 01 '15 at 09:34
  • Anyone else maybe? – Cojones May 07 '15 at 08:38

1 Answers1

1

Had a similar challenge recently and your location blocks now seem correct:

Nginx: Selective On/Off of Auth Basic Based on Realm

The persistent flux is probably due to browser caching, which caused me hours of wasted time also on this topic. Whenever you change any http auth settings, close the browser entirely, ideally reset it, then reopen the page and see if the new settings work as expected. That did the trick for me.

Would have added this as a comment to the answer above but don't have enough rep points yet.

Community
  • 1
JayMcTee
  • 3,763
  • 12
  • 20