usualoma
2/4/2017 - 8:57 PM

default.conf

server {
  listen 80;
  server_name default_server;

  set $secret_token 'ohkoNgi4quaoxahl'; # `$ pwgen 16 1`
  set $base64       'dGVzdDp0ZXN0';     # `$ echo -n 'test:test' | base64`

  location = /.secret-token-required.html {
    if ($http_authorization = "Basic $base64") {
      add_header Set-Cookie "secret_token=$secret_token;Path=/;Max-Age=31536000";
      return 302 /;
    }
    auth_basic "test site";
    auth_basic_user_file /dev/null;
  }
  if ($cookie_secret_token != $secret_token) {
    rewrite ^ /.secret-token-required.html break;
  }

  location / {
    proxy_pass http://backend;
  }
}