nginx location match on ssl_client_verify
<p>I'm trying to setup nginx in order to match certain URL on server where conditional access is granted (i.e. only those with valid client certificate are allowed to access this area).</p>

<p>Right now, simple location block works fine preventing access to unauthorized users:</p>

<pre><code>location ~ ^/protected/ticketing {
         if ($ssl_client_verify != SUCCESS) { return 401; }
#need treatment of php files here after SUCCESS = $ssl_client_verify ?!
}
</code></pre>

<p>So no one can access /protected/ticketing/anyThingHere</p>

<p>BUT. 
When you actually present a valid certificate, and this return 401 does not trigger, /protected/ticketing/index.php is not parsed by an upstream FPM server but instead is presented for download (i.e. content disposition is set to default octet stream). </p>

<p>Is there an elegant way of doing this?</p>

<p>My upstream is defined as:</p>

<pre><code>upstream backend {
server unix:/var/run/php5-fpm.sock;
}
</code></pre>

<p>PHP handler location block:</p>

<pre><code>location ~ [^/]\.php(/|$) {
 fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 if (!-f $document_root$fastcgi_script_name){return 404;}
 fastcgi_pass backend; #pass request to the upstream
 fastcgi_index index.php;
 include fastcgi_params;
}
</code></pre>