Authorization (401) issue with Nginx
<p>I have a Nginx virtualhost with the following content:</p>

<pre><code>server {
    listen 80;
    location /.well-known {
        alias /usr/local/etc/letsencrypt-webroot/.well-known;
    }
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/sub.domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sub.domain.com/privkey.pem;
    ssl_dhparam /etc/nginx/ssl/dh.pem;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_cookie_path / "/; secure; HttpOnly";
        auth_basic "No no no!";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}
</code></pre>

<p>I'm having a problem when the URL is <code>/.well-known/...</code>. I get a 401 because it keeps asking for credentials. </p>

<p>So my questions are:</p>

<ul>
<li><p>Why is <code>/.well-known</code> user-protected? Shouldn't it be processed before reaching the <code>location /</code> in the SSL section, which is the one requiring authentication?</p></li>
<li><p>How can I fix this? Basically I need that everything requested to the proxy needs authentication except for <code>/.well-known</code>.</p></li>
</ul>