What’s the difference between named location and an ordinary location with internal?
Where are named locations allowed? auth_request doesn’t need to be external but if I try auth_request @auths with a named location it doesn’t work. The error log has open() "/etc/nginx/html@auths" failed (2: No such file or directory) and subrequest: "@auths".
You’ve hit on a classic Nginx “gotcha.” The core issue is that named locations (@) and regular locations are handled fundamentally differently, and the standard auth_request module does not support named locations.
Regular Location : location /path { … }
Named Location (@) : location @name { … }
A regular location is a “door” for external traffic. A named location (@) is a purely internal “shortcut” that bypasses standard URI matching.
Named locations cannot be accessed directly by a browser or external client. They are strictly reserved for internal directives that perform an internal jump.
They only work with :
error_page – e.g., error_page 404 @fallback;
try_files – e.g., try_files $uri @fallback;
return (for internal redirects, though with limitations).
You receive error because the in standard NGINX, the auth_request directive does not accept named locations. Since you cannot use a named location, use a regular location marked as internal. This gives you the exact same security benefit (blocking external access) while remaining fully compatible with auth_request.
Example Fix:
location /private/ {
# Call the internal authentication subrequest
auth_request /auth;
# ... your proxy_pass or root config here
}
location = /auth {
# Crucial: prevents external users from hitting this endpoint directly
internal;
# Proxy to your authentication service
proxy_pass http://your_auth_service;
# Recommended: strip the request body for auth checks
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri;
# ... other proxy headers
}