Setting access restriction results in 403 forbidden error

[Elmardus]

I am using Nginx Proxy Manager v2.2.3. This problem started occurring after the update to v2.2.3.

I have setup a username with password in the access list. When applying this to a proxy ___domain, the site becomes inaccessible with a 403 forbidden error. No login window is displayed.

Error.log
2020/04/22 13:01:10 [error] 8411#8411: *210879 access forbidden by rule, client: IP_REDACTED, server: omv.REDACTED.eu, request: "GET / HTTP/2.0", host: "omv.REDACTED.eu"

proxy_host-4.log
[22/Apr/2020:13:01:10 +0000] - - 403 - GET https omv.REDACTED.eu "/" [Client IP_REDACTED] [Length 107] [Gzip 1.36] [Sent-to 192.168.178.100] "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0" "-"

[McCloudS]

This is similar behavior to what I was seeing with my issue in some cases. There's a chance this could be tied to mine #382

Have you checked to see if your .conf files have "satisfy all" or "satisfy any" correctly on (usually) line 43 below "#Access checks must..."?

[Elmardus]

I have just checked, the following is added to the /nginx/proxy_host/4.conf (starting at line 50):

  ___location / {

    # Authorization
    auth_basic            "Authorization required";
    auth_basic_user_file  /data/access/4;

    # Access Rules
    deny all;

    # Access checks must...
    satisfy all;

I haven't yet figured out if this is an incorrect configuration, or in what way this could cause the 403 forbidden error. Any ideas?

[jameski83]

I am getting the same issue on 2.2.3. It won't accept allow all as an entry via the web gui. If I edit the file /nginx/proxy_host/*.conf manually to allow all instead of deny all it works.

I want it to ask for basic auth when accessing via any IP address, not sure if this is the right way to do this or not. Please advise

[modem7]

#393 is possibly also related

[andyjhall]

Similar issue, I wish to use access rules without authorisation however the host still asks for basic auth. Most likely because there needs to be a check in code "if the user / password list is empty, dont include 'auth_basic' in the config file". This check needs to be put in the proxy_host.conf template

[radumpopescu]

I had the same issue.
It seems to be happening only when HTTP/2 Support is active on the proxy.
After I disabled it, it asked me for login and it worked.

[Indemnity83]

By design, a client will need to meet BOTH the authorization, and access rules defined on the access list unless you select the satisfy any option.

It sounds like you're only setting a username/password and not modifying the authorization rules or setting satisfy any and the default deny all rule in the authorization is resulting in a 403 response.

It sounds like your use case requires setting the satisfy any option on the access list to tell Nginx to let a user in if they satisfy either the Authentication or Access rules.

[Indemnity83]

Similar issue, I wish to use access rules without authorisation however the host still asks for basic auth. Most likely because there needs to be a check in code "if the user / password list is empty, dont include 'auth_basic' in the config file". This check needs to be put in the proxy_host.conf template

This is a different issue to the OP's ... I've submitted PR #403 to prevent the server asking for auth if no users are defined.

[Indemnity83]

It won't accept allow all as an entry via the web gui

This is also fixed in #402

[Elmardus]

I believe this issue has been fixed, on the current version access restrictions work without problems as far as I know.

[robertorubioguardia]

I had the same issue.
It seems to be happening only when HTTP/2 Support is active on the proxy.
After I disabled it, it asked me for login and it worked.

This solved the 403 in my case. HTTP/2 was messing up with the auth.

[robertorubioguardia]

just in case, it happened today on a fresh install of the last version. So maybe its not fully resolved.

[dioxidec]

Fresh install today, I get a 403 Forbidden when satisfy any is enabled if there is a username/pass on its own or if I also have a username/pass and allowed ip filled in. It also happens if the satisy all is disabled with both usr/pass and IP set. This is using the docker image on unraid community apps.

UPDATE: It seems you need to restart the docker after each change of an option for it to take effect. I now get the pop up for usr/pass etc