title: NGINX - Why can I bypass password authentication?
body: <p>I have a NGINX server and I use Apache-utility's for password requirement (.htpasswd). It MOSTLY works fine. The following this work fine:</p>
  
  <pre><code>example.com/admin
  example.com/admin/
  example.com/admin/index
  </code></pre>
  
  <p>but...
  When I type <code>example.com/admin/index.php</code> and don't type any password at all and press "abort" the server show's the index.php (without any CSS or JS files). I think my PHP-FPM is the problem. Please take a look:</p>
  
  <pre><code>location / {
      try_files $uri $uri.html $uri/ @extensionless-php;
      index index.html index.htm index.php;
  }
  
  location @extensionless-php {
      rewrite ^(.*)$ $1.php last;
  }
  
  location /admin {
      auth_basic "Restricted";
      auth_basic_user_file /admin/.htpasswd;
  }
  
  location ~ \.php$ {
      fastcgi_pass            127.0.0.1:9000;
      include                 fastcgi_params;
      fastcgi_param           SCRIPT_FILENAME $document_root$
  }
  </code></pre>