Support auth_basic inside if statements

[Cristian Măgherușan-Stanciu]

I have a quite complicated access control setup, basically everything needs to be blocked(return 403) unless the user comes from some IP ranges given in CIDR notation.

At some point later, we had to give a chance to people outside those IP ranges, who might still be allowed if they can log in with basic authentication.

Initially I had it set up with the ngx_http_access module, which worked quite well, this is how I had it done with Puppet/ERB:

satisfy any;

<%- @allowed_ip_ranges.each do |range| %>
allow <%= range %>;
<%- end %>                                                                    

deny all; 

<%if bool(require_authentication) %>
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/htpass_users;
<% end %>

Then at some point some of my servers had to be configured in order to redirect the external users somewhere else instead of just blocking them with a 403.

I had read ​http://nginx.org/en/docs/http/ngx_http_access_module.html and tried to follow the advice "In case of a lot of rules, the use of the ngx_http_geo_module module variables is preferable", so I attempted to refactor the access control code, and started using ngx_http_geo module which got me something like this:

geo $external_user {
  default 1;
  <%- @allowed_ip_ranges.each do |range| %>
  <%= range %> 0;
  <%- end %>
}
<% end %>
if ($external_user) {
<% if bool(require_authentication) %>
  auth_basic "Restricted";
  auth_basic_user_file /etc/nginx/htpass_users;
<% else %>
  return 403;
<% end %>
}

I then immediately noticed the nginx configuration was broken in the environment where basic auth was enabled, since auth_basic is not working inside the if. So eventually I had to revert to the previous code.

This wasn't so bad, bot now I have another requirement, I need to allow some user agents regardless where they're coming from. This would easily be doable with an if and a variable created using the ngx_http_geo module, but I can't use that because of the basic auth issue.

So I am hereby creating a feature request to implement support for auth_basic inside the if statements.

[Valentin V. Bartenev]

You are overcomplicating things. You don't need if for the case:

geo $auth_realm {
  default Restricted;
  <%- @allowed_ip_ranges.each do |range| %>
  <%= range %> off;
  <%- end %>
}
<% end %>
<% if bool(require_authentication) %>
  auth_basic $auth_realm;
  auth_basic_user_file /etc/nginx/htpass_users;
<% else %>
  return 403;
<% end %>

Note also: ​http://wiki.nginx.org/IfIsEvil

[Cristian Măgherușan-Stanciu]

Thanks, that's a great idea, I didn't think about doing it that way.