Mixing limit_except breaks rewrite functionality: workaround

F

9 Jul '23

On Fri, Jun 30, 2023 at 11:29:21AM +0200, Sten Gruener wrote:

Hi there,

> I trying to mix authentication for POST requests with some
> rewrite/proxy_pass logic. This mean that password is required only on
> POST/PUT requests.

This does not answer the question you asked, but is there a reason for
the "rewrite, rewrite, return, proxy_pass" sequence instead of just
using exactly "proxy_pass http://server:8081/;"

It looks like that should do what you want, so bugs in the handling of
more complicated configs would not apply.

Thanks,

    f
-- 
Francis Daly        francis at daoine.org

share

S

Sten_Grüner

10 Jul '23

An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20230710/2b642127/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: apple-touch-icon at 2.png
Type: image/png
Size: 6562 bytes
Desc: not available
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20230710/2b642127/attachment.png>

share

F

Francis

10 Jul '23

On Mon, Jul 10, 2023 at 06:27:04AM +0200, Sten Grüner wrote:

Hi there,

>   Got to do rewrites, since otherwise nginx breaks urlencoded query
>   parameters.

Yes, that sounds like a good reason to not just use "the obvious" config.

So -- following the example in the trac ticket that you linked, doing something like

===
http {
    map $request_uri $request_without_x {
        ~^/x/(.*) $1;
        default "";
    }

...

    server {
...
        location /x/ {
            limit_except GET OPTIONS {
                auth_basic "Write Access";
                auth_basic_user_file /etc/nginx/conf.d/htpasswd_write;
            }
            proxy_pass http://server:8081/$request_without_x;
        }
    }
}
===

looks like it should do what you want?

Cheers,

    f
-- 
Francis Daly        francis at daoine.org

share