According to their own documentation, if is Evil. They gave several examples that certain configurations will not work if an if directive is used. They don't go into detail as to why it behaves wrong differently than the user may expect, or give examples on how to rewrite those instances.

What they do however is to link to this article, which gives a rudimentary explanation that an if-directive within a location-directive creates another "pseudo-location", which ignores the other location blocks.

However, the examples seem counter-intuitive to me, even with the explanation. As such, I wanted to know if my specific configuration is safe, and if not, how it could better be re-written. I did my own testing of course and it seems to behave correctly. The following example is only the relevant fragement of the configuration file:

ssl_client_verify optional;

location /public {
    try_files $uri $uri/ =404;

location / {
    if ($ssl_client_verify != SUCCESS)
        return 403;
    try_files $uri $uri/ =404;

My main security concern is that I want to avoid exposing any content that is not in /public to anyone who does not have a valid certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.