Basic_auth in nginx?

Question

Nginx

There is a bunch of php-fpm and nginx. There is something like this in the config:
location ~ .php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www/site.ru$fastcgi_script_name;
include fastcgi_params;
gzip_static on;
}
location /somewhere/ {
auth_basic "Please log in";
auth_basic_user_file /var/somewhere/.htpasswd;
}
The problem, in fact, is this: by knocking on site.ru/somewhere, and not specifying the credentials, we will catch 401 and everything will be fine. But if you knock on site.ru/somewhere/index.php, the script will be successfully executed and give the result to the browser.
I understand, the question is idiotic, and yet - how to extend the authorization effect to the entire stuffing?

Answer 1

In general, the only working solution at the moment is this perversion:
location ~ /somewhere/.* {
auth_basic "Please log in";
auth_basic_user_file /var/somewhere/.htpasswd;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /var/www/site.ru/somewhere$fastcgi_script_name;
include fastcgi_params;
gzip_static on;
}
With a similar assembly of the location, the script is executed and the authorization works. However, I really, really do not like the monstrosity of such a design. I would be grateful if someone could help me find a more elegant solution.

Answer 2

Docks did not try to read?
They clearly say that the location of the locales does not matter, regular expressions have priority. Look at Igor's report on this matter, he explains it well there. I just don’t remember what the video is called, but he didn’t make so many reports about the config of his product).

Answer 3

I don't dare to give an exact answer, but:
1) swap location blocks?
2) google: nginx location override
2.1) serverfault.com/a/340601