How to check if the request header contains authorization in nginx - nginx

Question

I've read on this post that Nginx does not support multiple Authorization headers.
I was wondering if how I would check in the http request if an
authorization header is present.
basically I am adding a basic auth to my webpage since its not ready for production yet. My site is a single page application and I have successfully added authentication in the index page, but my site has also log in feature. When I log in it keeps asking for the authentication again. Im new to nginx and I am not quite sure how to get around with this
location / {
root /path/to/my/app/root/folder;
index index.html index.php;
#I want to only executed these lines only on the index page and login page
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}

Answer 1

You can use curl to see the headers:
$ curl -v -u your_user_name "http://......."
Look for the > Authorization: Basic ... line which contains a Base64 encoding of user:pass.
You can decode the string using:
printf auth_string | base64 --decode
More details here.
Also, make sure /etc/nginx/.htpasswd has the right permissions for nginx to be able to read it and that it contains your user/pass credentials in a format recognized by nginx (info here):
1. Plain text:
# comment
name1:password1
name2:password2:comment
name3:password3
2. Encrypted/hashed:
encrypted with the crypt() function; can be generated using the “htpasswd” utility from the Apache HTTP Server distribution or the
“openssl passwd” command;
hashed with the Apache variant of the MD5-based password algorithm (apr1); can be generated with the same tools;
specified by the “{scheme}data” syntax (1.0.3+) as described in RFC 2307; currently implemented schemes include PLAIN (an
example one, should not be used), SHA (1.3.13) (plain SHA-1
hashing, should not be used) and SSHA (salted SHA-1 hashing, used
by some software packages, notably OpenLDAP and Dovecot).
$ htpasswd
Usage:
htpasswd [-cimBdpsDv] [-C cost] passwordfile username
htpasswd -b[cmBdpsDv] [-C cost] passwordfile username password
htpasswd -n[imBdps] [-C cost] username
htpasswd -nb[mBdps] [-C cost] username password
-c Create a new file.
-n Don't update file; display results on stdout.
-b Use the password from the command line rather than prompting for it.
-i Read password from stdin without verification (for script usage).
-m Force MD5 encryption of the password (default).
-B Force bcrypt encryption of the password (very secure).
-C Set the computing time used for the bcrypt algorithm
(higher is more secure but slower, default: 5, valid: 4 to 31).
-d Force CRYPT encryption of the password (8 chars max, insecure).
-s Force SHA encryption of the password (insecure).
-p Do not encrypt the password (plaintext, insecure).
-D Delete the specified user.
-v Verify password for the specified user.
On other systems than Windows and NetWare the '-p' flag will probably not work.
The SHA algorithm does not use a salt and is less secure than the MD5 algorithm.