英文:
disabling basic auth on certain endpoints in nginx conf file does not work
问题
我正在尝试禁用网站特定端点的基本身份验证,因为一些第三方服务会发送请求到该站点。
我有两个EC2实例和一个位于它们后面的应用负载均衡器(ALB)。这是我的nginx配置文件。如您所见,在服务器块中启用了身份验证,并针对特定端点禁用了身份验证。但是,当我尝试访问特定端点时,例如https://website.domain/api/providers/bgaming/rollback,我仍然被提示输入用户名和密码,但实际上不应该。
upstream fpm_backend {
server unix:/run/php/php8.1-fpm.sock;
keepalive 256;
}
server {
listen 80 default_server;
server_name _;
root /home/xxxx/xxxx/public;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
index index.html index.htm index.php;
charset utf-8;
error_page 404 /index.php;
auth_basic "Restricted access";
auth_basic_user_file /etc/nginx/.htpasswd;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location /api/provider/aleaplay/callback/transactions {
auth_basic off;
}
location /api/provider/aleaplay/callback/players/ {
auth_basic off;
}
location /callback {
auth_basic off;
}
location /api/providers/bgaming/play {
auth_basic off;
}
location /api/providers/bgaming/rollback {
auth_basic off;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
location /web.config {
return 404;
}
location ~ \.php$ {
fastcgi_pass fpm_backend;
fastcgi_index index.php;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include fastcgi_params;
}
location ~ /\.(?!well-known).* {
deny all;
}
client_max_body_size 20M;
}
英文:
I am attempting to disable basic authentication for certain endpoints on my website, as some third-party services send requests to the site.
I have two EC2 instances and an Application Load Balancer (ALB) behind them. This is my nginx configuration file. As you can see, I have enabled authentication in the server block and disabled it for certain endpoints. However, when I try to access certain endpoints, such as https://website.domain/api/providers/bgaming/rollback, I am still prompted to enter a username and password, when I should not be.
upstream fpm_backend {
server unix:/run/php/php8.1-fpm.sock;
keepalive 256;
}
server {
listen 80 default_server;
server_name _;
root /home/xxxx/xxxx/public;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
index index.html index.htm index.php;
charset utf-8;
error_page 404 /index.php;
auth_basic "Restricted access";
auth_basic_user_file /etc/nginx/.htpasswd;
location / {
try_files $uri $uri/ /index.php?$query_string;
}
location /api/provider/aleaplay/callback/transactions {
auth_basic off;
}
location /api/provider/aleaplay/callback/players/ {
auth_basic off;
}
location /callback {
auth_basic off;
}
location /api/providers/bgaming/play {
auth_basic off;
}
location /api/providers/bgaming/rollback {
auth_basic off;
}
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }
location /web.config {
return 404;
}
location ~ \.php$ {
fastcgi_pass fpm_backend;
fastcgi_index index.php;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
include fastcgi_params;
}
location ~ /\.(?!well-known).* {
deny all;
}
client_max_body_size 20M;
}
答案1
得分: 0
根据您的配置,一切都由根index.php
文件处理。/index.php
URI由location ~ \.php$
块处理,并需要身份验证。
要禁用/api/providers/bgaming/rollback
的身份验证,您需要使用auth_basic off
并 在同一位置块内处理整个请求。
例如:
location ^~ /api/providers/bgaming/rollback {
auth_basic off;
try_files /index.php =404;
fastcgi_pass fpm_backend;
include fastcgi_params;
}
^~
操作符使此位置具有优先权(在这种特定情况下可能不是必需的)。try_files
语句将请求更改为index.php
,但由于它不是最后一个参数,因此请求仍在同一位置块中处理。最后两个语句处理请求作为PHP文件。
英文:
Looking at your configuration, everything ends up being handled by the root index.php
file. The /index.php
URI is handled by the location ~ \.php$
block and requires authentication.
To disable authentication for /api/providers/bgaming/rollback
, you will need to use auth_basic off
and handle the entire request within the same location block.
For example:
location ^~ /api/providers/bgaming/rollback {
auth_basic off;
try_files /index.php =404;
fastcgi_pass fpm_backend;
include fastcgi_params;
}
The ^~
operator causes this location to take precedence (which is probably not required in this particular case). The try_files
statement changes the request to index.php
but as it is not the last parameter, the request continues to be handled within the same location block. The final two statements processes the request as a PHP file.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论