Protect Piwik on Nginx with basic authentication, but allow access piwik.js

Question

I got nginx running on my server and recently installed Piwik with this config:

server {
  listen 443 ssl spdy;
  server_name analytics.example.org;
  root /srv/www/analytics.example.org;
  index index.php;

  ssl_certificate ssl-certificates/wildcard.example.org.crt;
  ssl_certificate_key ssl-certificates/wildcard.example.org.key;

  access_log           /var/log/nginx/analytics.example.org_access.log;
  error_log            /var/log/nginx/analytics.example.org_error.log;

  auth_basic           "HTTP Basic Authentication";
  auth_basic_user_file htpasswd/example;

  satisfy              any;
  include              example_ip;
  deny                 all;

  location ~*  \.(jpg|jpeg|png|gif|ico|css|js)$ {
    expires max;
  }

  location = /robots.txt {
    return 200 "User-agent: *\nDisallow: /\n";
  }

  location / {
    try_files $uri $uri/ /index.php?$args;
  }

  location ~ .php$ {
    try_files $uri $uri/index.php =404;
    include fastcgi.conf;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
  }

  location = /piwik.js {
    satisfy any;
    allow all;
    auth_basic off;
    try_files $uri =404;
  }
}

I'm trying to turn off basic auth for /piwik.js since it's requested from the app itself and it's always asking for username and password.

What am I doing wrong here?

--- Update 1 ---

Updated config:

...
location = /piwik.js {
  satisfy any;
  allow all;
  auth_basic off;
  try_files $uri =404;
}

location / {
  auth_basic           "Bitte authentifiziere dich.";
  auth_basic_user_file htpasswd/pass;

  satisfy              any;
  include              pass_ip;
  deny                 all;

  try_files $uri $uri/ /index.php?$args;
}
...

Now it let's me access piwik.js from the app and also asks for basic auth for analytics.example.org. However, when I click cancel, part of the website gets loaded, next basic auth, cancel, loading, etc.

--- Update 2 ---

I also added the basic auth stuff to the location ~ .php$ directive and it's working now, however having it in two places doesn't seem right. Anyway I can make it nicer?

score 1 · Accepted Answer · edited Apr 13 '17 at 12:14

Had a similar challenge recently and your location blocks now seem correct:

Nginx: Selective On/Off of Auth Basic Based on Realm

The persistent flux is probably due to browser caching, which caused me hours of wasted time also on this topic. Whenever you change any http auth settings, close the browser entirely, ideally reset it, then reopen the page and see if the new settings work as expected. That did the trick for me.

Would have added this as a comment to the answer above but don't have enough rep points yet.

Protect Piwik on Nginx with basic authentication, but allow access piwik.js

1 Answers1