Nginx – PHP脚本上的基本http身份验证

它的问题是我无法添加基本身份验证.
一旦我为位置/ cgi-bin启用它,当我尝试查找它时,它会给我一个404错误.

我怎么解决这个问题？

我想限制只访问我的第二台服务器,然后我在代理上添加基本身份验证,但必须有一个更简单的解决方案.

抱歉标题不好,我想不出更好的一个.

编辑：我的解决方案,感谢WerkkreWs answer,最终看起来像这样：

CGI-bin.conf：

location ~^/.*\.(cgi|pl|p<|rb) {
    [...]
}

vhost.conf：

server {
    [...]
    location ~^/cgi-bin {
        auth_basic "Restricted";
        auth_basic_user_file htusers;
        include cgi-bin.conf;
    }
    [...]
}

这可能是不安全的,因为cgi-bin.conf可能会意外地包含在服务器标签中(从而使每个客户端都能在每个位置执行脚本),但由于我只使用它一次,我将坚持使用此解决方案.
最佳答案
我相信你的问题可能已经回答了here,但我会尝试描述我认为问题所在.

首先,除此之外,您应该考虑将所有fastcgi参数放在nginx可访问的configurastion文件中以便于使用(例如/etc/nginx/conf.d/fastcgi_params).

其次,根据你如何设置auth与php部分的位置块,你可能需要指示nginx如何在受保护的位置再次处理php文件,或者确保auth_basic指令在例如,与上面粘贴的位置块相同的位置块(取自上述帖子)：

server {
  listen 80;
  server_name my-awesome-php.site;
  root /path/to/root;

  # Normal files (blank location is OK,just means serve from root)
  location / {  }  

  # PHP for normal stuff
  location ~ \.php${
    include fastcgi.conf;
    fastcgi_pass  127.0.0.1:9000;
  } 

  # The protected location
  location /protected {
    auth_basic "Give me codes.";
    auth_basic_user_file /path/to/.htpasswd;
    location ~ \.php${
      include fastcgi.conf;
      fastcgi_pass  127.0.0.1:9000;
    }
  }
}

在我个人安装的nginx上我使用的是php-fpm,我的php脚本不仅限于cgi-bin,所以我的配置完全不同,但它可能会为你提供一些额外的见解.我有基本的身份验证工作,因为我想你会期待它虽然在下面的例子中整个vhost是在基本身份验证而不仅仅是一个文件夹：

fastcgi_params

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;
fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;
# PHP only,required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;

基于服务器/主机的身份验证示例(删除了不相关的部分)

server {
        server_name dev.foo.com;

        error_log /app/www/dev.foo.com/logs/error.log error;

        root /app/www/dev.foo.com/htdocs;
        index index.php index.html;

        auth_basic "Secret Files";
        auth_basic_user_file /app/www/dev.foo.com/conf/htpasswd;

        location ~ \.php${
                include       /etc/nginx/fastcgi_params;
                fastcgi_index index.php;
                fastcgi_split_path_info ^(.+\.php)(.*)$;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass  unix:/var/run/foo.com.sock;
        }


        location ~ /\.ht {
                deny all;
        }
}

基于位置的身份验证示例(删除了不相关的部分)

server {
        server_name foo.com;

        error_log /app/www/foo.com/logs/error.log error;

        root /app/www/foo.com/htdocs;
        index index.php index.html;

        location /protected {            
            auth_basic "Secret Files";
            auth_basic_user_file /app/www/foo.com/conf/htpasswd;

            location ~ \.php${
                include       /etc/nginx/fastcgi_params;
                fastcgi_index index.php;
                fastcgi_split_path_info ^(.+\.php)(.*)$;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                fastcgi_pass  unix:/var/run/foo.com.sock;
            }
        }

        location ~ \.php${
            include       /etc/nginx/fastcgi_params;
            fastcgi_index index.php;
            fastcgi_split_path_info ^(.+\.php)(.*)$;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_pass  unix:/var/run/foo.com.sock;
        }

        location ~ /\.ht {
            deny all;
        }
}