title: Why ignores nginx my "auth_basic off" for sub-path location directive?
body: <p>Nginx (<a href="https://hub.docker.com/_/nginx" rel="nofollow noreferrer">docker image</a>, <code>1.17.2</code>) requires a basic authentication for a subpath. Although my config says otherwise for <code>https://example.org/subpath</code>:</p>
  
  <pre><code>//  /etc/nginx/conf.d/mysetup.conf
  
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;
  
  server {
      listen 443 ssl;
      server_name example.org;
      server_tokens off;
  
      ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem;
      ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;
      include /etc/letsencrypt/options-ssl-nginx.conf;
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
  
      access_log /var/logs/nginx/example.org.access.log;
      error_log /var/logs/nginx/example.org.error.log info;
  
      root /var/www/domains/example.org/stage_root/;        
  
      location / {
          auth_basic "example.org server";
          auth_basic_user_file /var/htaccess/htaccess_example.org;
      }
      location /subpath {
          auth_basic off;
          root /var/www/domains/example.org/;
      }
  }
  </code></pre>
  
  <p><strong>Some Facts:</strong></p>
  
  <ul>
  <li>nignx accepts my conf without warnings</li>
  <li>There are more domains served (all in similar <code>server</code> directives) and an upstream plex.</li>
  <li>the docker image is part of <code>docker-compose</code> setup with its own network (nginx is the gate)</li>
  <li>The correct content is served: <code>/var/www/domains/example.org/subpath/</code></li>
  <li>Commenting-out the global <code>auth_basic</code> disables the auth request</li>
  </ul>
  
  <p><strong>What I've tried so far:</strong></p>
  
  <ul>
  <li>Moving the auth_basic setup from the <code>location /</code> block up to the <code>server</code> block.</li>
  <li><code>off</code> with double-quotes (<a href="https://serverfault.com/a/566702">suggested</a>, although not required in the <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/" rel="nofollow noreferrer">docs</a>)</li>
  <li>searched for invalid chars/whitespaces</li>
  <li>removing the complete <code>location /</code> block</li>
  </ul>
  
  <p>IMHO this is standard use case, hence I guess something small slipped my eye or I am missing out some context knowledge. </p>
  
  <p>Maybe nginx has a problem with a <code>location</code> block <code>root</code> that higher than the global <code>root</code>? It serves the content though.. </p>
  
  <p><strong>What I haven't tried, yet:</strong></p>
  
  <ul>
  <li>Working with <code>allow</code> / <code>deny</code>, as it <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/" rel="nofollow noreferrer">should</a> work without</li>
  </ul>
  
  <p><strong>Possible duplicate question:</strong></p>
  
  <p>Specifically <a href="https://stackoverflow.com/questions/9281564/nginx-auth-basic-for-everything-except-a-specific-location">this question</a> is quite similar. However it does not have the 'twist' with the different root dir and the answers haven't helped: <a href="https://stackoverflow.com/a/9281829/6919635">1st</a> not working, <a href="https://stackoverflow.com/a/22232552/6919635">2nd</a> seems to be quite a workaround.</p>