[GH-ISSUE #148] Proxy Host Custom Locations do not apply Access Lists

Author

Owner

@jc21 commented on GitHub (May 22, 2019):

ahh yeah definitely an oversight

@jc21 commented on GitHub (May 22, 2019): ahh yeah definitely an oversight

kerem commented

Author

Owner

@emko commented on GitHub (Jul 3, 2019):

can we enable the auth in custom ngix configuration?

@emko commented on GitHub (Jul 3, 2019): can we enable the auth in custom ngix configuration?

kerem commented

Author

Owner

@meiskam commented on GitHub (Aug 3, 2019):

It'd be nice to have Access List box show up for each custom location, so I can have a custom location with a password and the main bit without one

@meiskam commented on GitHub (Aug 3, 2019): It'd be nice to have Access List box show up for each custom location, so I can have a custom location with a password and the main bit without one

kerem commented

Author

Owner

@jValdron commented on GitHub (Aug 6, 2019):

@meiskam, just add the following to your custom location "advanced options":

auth_basic            "Authorization required";
auth_basic_user_file  /data/access/{{ access_list_id }};

Taken from the proxy_host.conf template: https://github.com/jc21/nginx-proxy-manager/blob/master/src/backend/templates/proxy_host.conf

@jValdron commented on GitHub (Aug 6, 2019): @meiskam, just add the following to your custom location "advanced options": ``` auth_basic "Authorization required"; auth_basic_user_file /data/access/{{ access_list_id }}; ``` Taken from the _proxy_host.conf_ template: https://github.com/jc21/nginx-proxy-manager/blob/master/src/backend/templates/proxy_host.conf

kerem commented

Author

Owner

@jgearinger commented on GitHub (Dec 3, 2019):

still an issue... creates a pretty big security hole if you do not test specifically for this issue.

@jgearinger commented on GitHub (Dec 3, 2019): still an issue... creates a pretty big security hole if you do not test specifically for this issue.

kerem commented

Author

Owner

@ahknight commented on GitHub (Feb 11, 2020):

I just ran into this as I wanted different levels of access for different apps on a domain. It’s also not easy to find out the ACL ID remotely (VPN, browser only) so I had to go guessing. It’d be nice to have a menu for each custom location to pick the ACL for it and have it just insert that blob.

@ahknight commented on GitHub (Feb 11, 2020): I just ran into this as I wanted different levels of access for different apps on a domain. It’s also not easy to find out the ACL ID remotely (VPN, browser only) so I had to go guessing. It’d be nice to have a menu for each custom location to pick the ACL for it and have it just insert that blob.

kerem commented

Author

Owner

@wtf911 commented on GitHub (Apr 15, 2020):

Would also like to see this fixed please!

@wtf911 commented on GitHub (Apr 15, 2020): Would also like to see this fixed please!

kerem commented

Author

Owner

@clb92 commented on GitHub (May 15, 2020):

This is actually a pretty big issue for me, that locations don't inherit the host's access control.

I can't even get the solution above (adding auth_basic and auth_basic_user_file to the custom location) to work correctly:

If I use same access list on both host and location

My host subdomain.domain.com goes to one web server. It has access list 0 added to it through the dropdown list selector.

My custom location /subdir goes to another web server. It also has access list 0 added, by the two lines in the custom location config.

If I visit subdomain.domain.com/ and authenticate, that site displays fine, but if I then go to /subdir/, I always get 403 Forbidden.

If I visit subdomain.domain.com/subdir/ directly (without authenticating on subdomain.domain.com/ first), it will ask me to authenticate, but then I still get 403 Forbidden on, no matter what I do.

If I use different access lists on host and location it works

My host subdomain.domain.com still has access list 0 added to it.

But now, custom location /subdir has access list 1 added instead.

Now it works more as expected. Navigating to subdomain.domain.com asks for auth, and then going to subdomain.domain.com/subdir/ also asks for auth (but different credentials).

Navigating between the pages, it will keep asking for auth, since you can apparently only be authenticated with one set of credentials on one domain. This is expected.

The problem?

Studying the Docker container log, I see this line when I save the proxy settings through the GUI:

Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0

No idea if it's related.

So, is it just a bug in NPM that a host and a location (on that same host) can't use the same access list?

If anyone knows how to fix this, please let me know.

EDIT: For now, I can have the same access list on the host and location by actually making another access list (with same list of credentials in it) and using one list on the host, and the clone on the location. Works for now, but it's a terrible solution.

@clb92 commented on GitHub (May 15, 2020): This is actually a pretty big issue for me, that locations don't inherit the host's access control. I can't even get the solution above (adding auth_basic and auth_basic_user_file to the custom location) to work correctly: ## If I use same access list on both host and location My host ```subdomain.domain.com``` goes to one web server. It has ```access list 0``` added to it through the dropdown list selector. My custom location ```/subdir``` goes to another web server. It also has ```access list 0``` added, by the two lines in the custom location config. If I visit ```subdomain.domain.com/``` and authenticate, that site displays fine, but if I then go to ```/subdir/```, I always get 403 Forbidden. If I visit ```subdomain.domain.com/subdir/``` directly (without authenticating on ```subdomain.domain.com/``` first), it will ask me to authenticate, but then I still get 403 Forbidden on, no matter what I do. ## If I use different access lists on host and location it works My host ```subdomain.domain.com``` still has ```access list 0``` added to it. But now, custom location ```/subdir``` has ```access list 1``` added instead. Now it works more as expected. Navigating to ```subdomain.domain.com``` asks for auth, and then going to ```subdomain.domain.com/subdir/``` also asks for auth (but different credentials). Navigating between the pages, it will keep asking for auth, since you can apparently only be authenticated with one set of credentials on one domain. This is expected. ## The problem? Studying the Docker container log, I see this line when I save the proxy settings through the GUI: Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0 No idea if it's related. So, is it just a bug in NPM that a host and a location (on that same host) can't use the same access list? If anyone knows how to fix this, please let me know. **EDIT:** For now, I can have the same access list on the host and location by actually making another access list (with same list of credentials in it) and using one list on the host, and the clone on the location. Works for now, but it's a terrible solution.

kerem commented

Author

Owner

@colonelmattyman commented on GitHub (Sep 3, 2020):

Websockets on Custom Domains are also broken because of this. I really think that this bug needs some urgent attention and a fast resolution. It's been open since 23 May 2019.

@colonelmattyman commented on GitHub (Sep 3, 2020): Websockets on Custom Domains are also broken because of this. I really think that this bug needs some urgent attention and a fast resolution. It's been open since 23 May 2019.

kerem commented

Author

Owner

@Tezzlicious commented on GitHub (Sep 3, 2020):

Must agree. Issue needs an urgent fix or needs to be mentioned on the homepage. Thanks for the efforts.

@Tezzlicious commented on GitHub (Sep 3, 2020): Must agree. Issue needs an urgent fix or needs to be mentioned on the homepage. Thanks for the efforts.

kerem commented

Author

Owner

@colonelmattyman commented on GitHub (Sep 10, 2020):

I ended up rolling back to V1.5.0 to fix it.

@colonelmattyman commented on GitHub (Sep 10, 2020): I ended up rolling back to V1.5.0 to fix it.

kerem commented

Author

Owner

@clb92 commented on GitHub (Sep 10, 2020):

Random small problems like these have made me switch to Caddy. Sorry jc21!

@clb92 commented on GitHub (Sep 10, 2020): Random small problems like these have made me switch to Caddy. Sorry jc21!

kerem commented

Author

Owner

@colonelmattyman commented on GitHub (Sep 11, 2020):

Random small problems like these have made me switch to Caddy. Sorry jc21!

Right? Although I don't think a lack of authentication should be classed as a small problem.

@colonelmattyman commented on GitHub (Sep 11, 2020): > Random small problems like these have made me switch to Caddy. Sorry jc21! Right? Although I don't think a lack of authentication should be classed as a small problem.

kerem commented

Author

Owner

@ghost commented on GitHub (Feb 14, 2021):

How has this bug been open for almost 2 years?

@ghost commented on GitHub (Feb 14, 2021): How has this bug been open for almost 2 years?

kerem commented

Author

Owner

@NovaViper commented on GitHub (Feb 16, 2021):

Is there a fix for this??? I have a mission-critical sever that requires basic auth and it doesn't even run without custom locations; it seems to be broken for me entirely. Using v2.8.0

@NovaViper commented on GitHub (Feb 16, 2021): Is there a fix for this??? I have a mission-critical sever that requires basic auth and it doesn't even run **without** custom locations; it seems to be broken for me entirely. Using v2.8.0

kerem commented

Author

Owner

@fistwho commented on GitHub (Mar 5, 2021):

No Update so far? @jc21

@fistwho commented on GitHub (Mar 5, 2021): No Update so far? @jc21

kerem commented

Author

Owner

@Kooramah commented on GitHub (Mar 10, 2021):

I just ran into this issue myself, any updates on whether this will be fixed or not

@Kooramah commented on GitHub (Mar 10, 2021): I just ran into this issue myself, any updates on whether this will be fixed or not

kerem commented

Author

Owner

@failserver commented on GitHub (Mar 21, 2021):

Just ran into this same issue with trying to setup guacamole with a custom location. Access list are not applying to the proxy host.

@failserver commented on GitHub (Mar 21, 2021): Just ran into this same issue with trying to setup guacamole with a custom location. Access list are not applying to the proxy host.

kerem commented

Author

Owner

@markspivey commented on GitHub (Jun 3, 2021):

@meiskam, just add the following to your custom location "advanced options":
auth_basic            "Authorization required";
auth_basic_user_file  /data/access/{{ access_list_id }};
Taken from the proxy_host.conf template: https://github.com/jc21/nginx-proxy-manager/blob/master/src/backend/templates/proxy_host.conf

Lucky I found this thread because I initially thought this was an issue on my end. But just to reiterate that this solution above does solve the issue. As a working example, I added the following to advanced options for each of my custom locations (based on my personal preferences when setting up the access list):

auth_basic "Authorization required";
auth_basic_user_file /data/access/1;
proxy_set_header Authorization "";
deny all;
satisfy any;

auth_basic_user_file /data/access/1; would correspond to the respective file/access list you want to use.

@markspivey commented on GitHub (Jun 3, 2021): > @meiskam, just add the following to your custom location "advanced options": > > ``` > auth_basic "Authorization required"; > auth_basic_user_file /data/access/{{ access_list_id }}; > ``` > > Taken from the _proxy_host.conf_ template: https://github.com/jc21/nginx-proxy-manager/blob/master/src/backend/templates/proxy_host.conf Lucky I found this thread because I initially thought this was an issue on my end. But just to reiterate that this solution above does solve the issue. As a working example, I added the following to advanced options for each of my custom locations (based on my personal preferences when setting up the access list): ``` auth_basic "Authorization required"; auth_basic_user_file /data/access/1; proxy_set_header Authorization ""; deny all; satisfy any; ``` auth_basic_user_file /data/access/1; would correspond to the respective file/access list you want to use.

kerem commented

Author

Owner

@investlab commented on GitHub (Sep 13, 2021):

How can i enable basic auth sitewide and disabling it for subpages?
Anyone can access sub-location without Basic Authorization.

@investlab commented on GitHub (Sep 13, 2021): How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization.

kerem commented

Author

Owner

@TheClockTwister commented on GitHub (Oct 4, 2021):

As of v2.9.9, this seems to be an issue that wasn't completely eliminated in #1081...

If I create a clean instance of the image and use a basic proxy host with access list using Basic Auth, the file in /data/access/xxx is created, but not included in the proxy host's configuration. After manually adding the following block as suggested by @markspivey, everything works fine...

auth_basic "Authorization required";
auth_basic_user_file /data/access/xxx;
proxy_set_header Authorization "";
deny all;
satisfy any;

Thanks for this awesome project! I hope this bug will be fixed for good... :)

@TheClockTwister commented on GitHub (Oct 4, 2021): As of `v2.9.9`, this seems to be an issue that wasn't completely eliminated in #1081... If I create a clean instance of the image and use a basic proxy host with access list using Basic Auth, the file in `/data/access/xxx` is created, but not included in the proxy host's configuration. After manually adding the following block as suggested by @markspivey, everything works fine... ``` auth_basic "Authorization required"; auth_basic_user_file /data/access/xxx; proxy_set_header Authorization ""; deny all; satisfy any; ``` Thanks for this awesome project! I hope this bug will be fixed for good... :)

kerem commented

Author

Owner

@aw-jansen commented on GitHub (Jun 15, 2022):

How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization.
Did you find a solution for this? @wisoez

@aw-jansen commented on GitHub (Jun 15, 2022): > How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization. Did you find a solution for this? @wisoez

kerem commented

Author

Owner

@ksarnelli commented on GitHub (Dec 9, 2022):

How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization.
Did you find a solution for this? @wisoez

@investlab @aw-jansen

Did either of you guys ever figure this out? Adding auth_basic "off"; to a location's custom config seems to put the host into Offline mode for me.

@ksarnelli commented on GitHub (Dec 9, 2022): > > How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization. > > Did you find a solution for this? @wisoez @investlab @aw-jansen Did either of you guys ever figure this out? Adding `auth_basic "off";` to a location's custom config seems to put the host into Offline mode for me.

kerem commented

Author

Owner

@aw-jansen commented on GitHub (Dec 10, 2022):

Unfortunately it worked only when using the manual configuration to
configure the whole domain. Far from ideal however.

On Fri, Dec 9, 2022, 23:18 ksarnelli @.***> wrote:

How can i enable basic auth sitewide and disabling it for subpages? Anyone
can access sub-location without Basic Authorization.
Did you find a solution for this? @wisoez https://github.com/wisoez

@wisoez https://github.com/wisoez @aw-jansen
https://github.com/aw-jansen

Did either of you guys ever figure this out? Adding auth_basic "off"; to
a location's custom config seems to put the host into Offline mode for me.

—
Reply to this email directly, view it on GitHub
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/148#issuecomment-1344839850,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABSPDGTPVO6Y3FRNY6SDPIDWMOV4LANCNFSM4HOYYQJQ
.
You are receiving this because you were mentioned.Message ID:
@.***>

@aw-jansen commented on GitHub (Dec 10, 2022): Unfortunately it worked only when using the manual configuration to configure the whole domain. Far from ideal however. On Fri, Dec 9, 2022, 23:18 ksarnelli ***@***.***> wrote: > How can i enable basic auth sitewide and disabling it for subpages? Anyone > can access sub-location without Basic Authorization. > Did you find a solution for this? @wisoez <https://github.com/wisoez> > > @wisoez <https://github.com/wisoez> @aw-jansen > <https://github.com/aw-jansen> > > Did either of you guys ever figure this out? Adding auth_basic "off"; to > a location's custom config seems to put the host into Offline mode for me. > > — > Reply to this email directly, view it on GitHub > <https://github.com/NginxProxyManager/nginx-proxy-manager/issues/148#issuecomment-1344839850>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABSPDGTPVO6Y3FRNY6SDPIDWMOV4LANCNFSM4HOYYQJQ> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

kerem commented

Author

Owner

@ksarnelli commented on GitHub (Dec 10, 2022):

Unfortunately it worked only when using the manual configuration to configure the whole domain. Far from ideal however.
…
On Fri, Dec 9, 2022, 23:18 ksarnelli @.> wrote: How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization. Did you find a solution for this? @wisoez https://github.com/wisoez @wisoez https://github.com/wisoez @aw-jansen https://github.com/aw-jansen Did either of you guys ever figure this out? Adding auth_basic "off"; to a location's custom config seems to put the host into Offline mode for me. — Reply to this email directly, view it on GitHub <#148 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABSPDGTPVO6Y3FRNY6SDPIDWMOV4LANCNFSM4HOYYQJQ . You are receiving this because you were mentioned.Message ID: @.>

Bummer - that was my suspicion. Thanks!

@ksarnelli commented on GitHub (Dec 10, 2022): > Unfortunately it worked only when using the manual configuration to configure the whole domain. Far from ideal however. > […](#) > On Fri, Dec 9, 2022, 23:18 ksarnelli ***@***.***> wrote: How can i enable basic auth sitewide and disabling it for subpages? Anyone can access sub-location without Basic Authorization. Did you find a solution for this? @wisoez <https://github.com/wisoez> @wisoez <https://github.com/wisoez> @aw-jansen <https://github.com/aw-jansen> Did either of you guys ever figure this out? Adding auth_basic "off"; to a location's custom config seems to put the host into Offline mode for me. — Reply to this email directly, view it on GitHub <[#148 (comment)](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/148#issuecomment-1344839850)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABSPDGTPVO6Y3FRNY6SDPIDWMOV4LANCNFSM4HOYYQJQ> . You are receiving this because you were mentioned.Message ID: ***@***.***> Bummer - that was my suspicion. Thanks!

kerem commented

Author

Owner

@alneven commented on GitHub (May 14, 2023):

Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0

any idea why I have this in the logs? (I'm on docker, with version v2.10.3)

@alneven commented on GitHub (May 14, 2023): ``` Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0 ``` any idea why I have this in the logs? (I'm on docker, with version v2.10.3)

kerem commented

Author

Owner

@natechoiniere commented on GitHub (Sep 5, 2023):

Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0
any idea why I have this in the logs? (I'm on docker, with version v2.10.3)

I'm also seeing this.

@natechoiniere commented on GitHub (Sep 5, 2023): > ``` > Duplicate relation "access_list" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0 > ``` > > any idea why I have this in the logs? (I'm on docker, with version v2.10.3) I'm also seeing this.

kerem commented

Author

Owner

@kpleines commented on GitHub (Dec 14, 2023):

Same here.
V2.10.4

@kpleines commented on GitHub (Dec 14, 2023): Same here. V2.10.4

kerem commented

Author

Owner

@vtmocanu commented on GitHub (Dec 17, 2023):

Unfortunately it worked only when using the manual configuration to configure the whole domain. Far from ideal however.

can you please share an example of the manual config for the whole domain?

@vtmocanu commented on GitHub (Dec 17, 2023): > Unfortunately it worked only when using the manual configuration to configure the whole domain. Far from ideal however. can you please share an example of the manual config for the whole domain?

kerem commented

Author

Owner

@W1BTR commented on GitHub (Jun 30, 2025):

Same issue here! Rather annoying

@W1BTR commented on GitHub (Jun 30, 2025): Same issue here! Rather annoying

kerem commented

Author

Owner

@W1BTR commented on GitHub (Jun 30, 2025):

Adding

auth_basic            "Authorization required";
auth_basic_user_file  /data/access/{{ access_list_id }};

Causes it to fail and show that host as "offline" for me, unfortunately.

I also tried having that chunk of code, plus disabling the access list from the main gui page, which now does prompt for a login but says "unauthorized" even after signing in.

@W1BTR commented on GitHub (Jun 30, 2025): Adding ``` auth_basic "Authorization required"; auth_basic_user_file /data/access/{{ access_list_id }}; ``` Causes it to fail and show that host as "offline" for me, unfortunately. I also tried having that chunk of code, plus disabling the access list from the main gui page, which now does prompt for a login but says "unauthorized" even after signing in.

kerem commented