How to configure Nginx user authentication page

Preface

Application scenario: Probably the internal website needs to be accessed by external users, and at the same time, visitors cannot be given website account permissions, so restrictions are imposed at the nginx level. For example, in outsourcing projects, internal employees have accounts to operate documents, while outsourced employees do not have internal accounts, but they need to be able to see the documents. Therefore, setting user authentication at the nginx level is the best and simplest option. In most cases, employers will not Open an account with basic access rights for outsourced employees.

Prerequisites for user authentication at the nginx level: a corresponding password creation program is required, such as apache2-utils (debian, ubuntu) or httpd-tools (rhel/centos/oracle linux), different operations Systems are different software.

Create account password file

• Use command sudo htpasswd -c /etc/apache2/.htpasswd user1 Create the first account, then press the enter key to enter the password. The same command does not have the -c parameter to create the second user and password. The -c parameter is to create a file. There is no need to repeat it in the second and subsequent commands. Create a file.

• Confirm that the file and account information are generated successfully. Use the command cat /etc/apache2/.htpasswd to view the file content. It should be the account number and encrypted password, such as: user1 :$apr1$/woc1jnp$kah0ssvn5qesmjttn0e9q0 etc.

Configure nginx for http basic user authentication

Use the auth_basic directive to specify the name of the protected area. This name will be displayed in On the account and password pop-up window, use the auth_basic_user_file command to set the .htpasswd path with account and password information. For example, configuration:

location /api {
 auth_basic   "administrator's area";
 auth_basic_user_file /etc/apache2/.htpasswd; 
}

In addition, if a block does not want to inherit the entire authentication system, you can set auth_basic off in the block, that is, user authentication is turned off. For example configuration:

server {
 ...
 auth_basic   "administrator's area";
 auth_basic_user_file conf/htpasswd;

 location /public/ {
  auth_basic off;
 }
}

Combining authentication with access restrictions by ip address

http Basic authentication can be effectively combined with access restrictions by ip address. You can implement at least two scenarios:

• Users need to be authenticated and have ip access

• Users need to be authenticated or have ip Access permissions

1. Use the allow and deny directives to allow or restrict access to the specified IP, for example, configure:

location /api {
 #... deny 192.168.1.2;
 allow 192.168.1.1/24;
 allow 127.0.0.1;
 deny all;
}

2, at the 192.168.1.2 address For other networks, only access to 192.168.1.1/24 is granted. Note: allow and deny directives will be applied in the order defined.

Combine restrictions with the satisfy directive via ip and http authentication. If the directive is set to all, access is granted when the client meets these two conditions. If the directive is set to any, access is granted if the client meets at least one condition, for example configuration:

location /api {
 #... satisfy all; 

 deny 192.168.1.2;
 allow 192.168.1.1/24;
 allow 127.0.0.1;
 deny all;

 auth_basic   "administrator's area";
 auth_basic_user_file conf/htpasswd;
}

The above can be organized into a complete example:

http {
 server {
  listen 192.168.1.23:8080;
  root /usr/share/nginx/html;

  location /api {
   api;
   satisfy all;

   deny 192.168.1.2;
   allow 192.168.1.1/24;
   allow 127.0.0.1;
   deny all;

   auth_basic   "administrator's area";
   auth_basic_user_file /etc/apache2/.htpasswd; 
  }
 }
}

The final effect is as shown:

The above is the detailed content of How to configure Nginx user authentication page. For more information, please follow other related articles on the PHP Chinese website!