Enable Authorization(password protected) page on nginx – Ubuntu

Introduction

In some situations, you may want to restrict access to a specific page or directory on a website. Password protection can prevent unauthorised users from accessing sensitive content and can also help prevent unwanted access by automated users or bots.

This guide explains how to configure HTTP Basic Authentication on an Nginx web server running on Ubuntu.

If Nginx is not installed on the server, refer to the related Nginx installation article mentioned below.

Prerequisites

Before implementing password protection, make sure you have:

• Ubuntu server.
• Nginx web server installed.
• Root or sudo access.
• Nginx configuration directory located at /etc/nginx.
• A website or directory that you want to protect.

Implementation

Step 1: Identify the Directory to Protect

In this example, assume that the web folder needs to be protected with a username and password.

The directory is:

/var/www/html/web

If there is only one domain on the server, the Nginx configuration file is:

/etc/nginx/sites-enabled/default

For a domain-specific configuration, edit the appropriate Nginx virtual host configuration file instead.

Step 2: Edit the Nginx Configuration

Open the Nginx configuration file:

vi /etc/nginx/sites-enabled/default

Add the following configuration inside the server {} block:

location /web/ {
    auth_basic "Restricted Content";
    auth_basic_user_file /var/www/html/web/.htpasswd;
}

The auth_basic directive enables password authentication, while auth_basic_user_file specifies the file containing the authentication credentials.

In this example, the password file is:

/var/www/html/web/.htpasswd

You can store the .htpasswd file in another location if you prefer to keep it outside the document root.

Step 3: Install htpasswd

The htpasswd command is used to create and manage the password file.

If the command is not available, install the apache2-utils package:

apt-get install apache2-utils

Step 4: Create the Password File

Create the password file and add a user:

htpasswd -c /var/www/html/.htpasswd username

You will be prompted to enter and confirm the password:

New password:
Re-type new password:
Adding password for user username

Note: The original configuration points Nginx to /var/www/html/web/.htpasswd, while the example htpasswd command creates /var/www/html/.htpasswd. Make sure both paths match. For the configuration above, create the file at /var/www/html/web/.htpasswd, or update auth_basic_user_file to the actual file location.

Step 5: Test the Nginx Configuration

Before restarting Nginx, check the configuration for syntax errors:

nginx -t

A successful configuration test should return output similar to:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Step 6: Restart Nginx

Restart Nginx to apply the configuration:

systemctl restart nginx

Step 7: Access the Protected Page

Open the following URL in your browser:

http://IPADDRESS/web

The browser will display an authentication prompt requesting the configured username and password.

After providing valid credentials, the protected page will become accessible.

Conclusion

Nginx HTTP Basic Authentication provides a simple way to restrict access to specific website directories. By configuring auth_basic, creating an .htpasswd file, testing the Nginx configuration, and restarting the service, you can password-protect a particular URL or directory on an Ubuntu server.

For sensitive applications, use HTTPS so that credentials are not transmitted over an unencrypted HTTP connection.

FAQs

1. What is Nginx Basic Authentication?

Nginx Basic Authentication is an HTTP authentication mechanism that requires users to provide a username and password before accessing a protected location.

2. What is the purpose of the .htpasswd file?

The .htpasswd file stores the usernames and password hashes used by Nginx to authenticate users.

3. How can I check whether my Nginx configuration is valid?

Run:

nginx -t

This checks the Nginx configuration for syntax errors before you restart or reload the service.

4. Can I protect only one directory instead of the entire website?

Yes. The location block can be configured for a specific path, such as:

location /web/ {
    auth_basic "Restricted Content";
    auth_basic_user_file /var/www/html/web/.htpasswd;
}

5. Is Basic Authentication secure?

Basic Authentication should be used with HTTPS. Without HTTPS, the credentials are not adequately protected during transmission.

Related Articles

• How to Hide Web Server Information / Modify Server Header in Nginx – Learn how to modify Nginx server header information to reduce unnecessary web server details being exposed.
  Read the article
• Adding Automatic PHP Extension in Nginx – Learn how to configure Nginx to handle PHP files automatically.
  Read the article

Talk to our experts

Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.