nginx simple deny rule not enforced - .htaccess

Question

I'm kind of ashame to bother you with a question so simple but I cannot figure out why the configuration of nginx is not enforcing a simple deny rule for a subfolder and really hope you can push me to the obvious mistake.
So, the setup: I got an nginx webserver running, /var/www is root directory and there are some subfolders. SSL is enforced and as I am using baikal CalDAV/CardDAV the settings for fastcgi origin from the corresponding documentation. Here is the currently working config file:
server {
listen 443 ssl;
root /var/www;
index index.html index.htm index.php;
server_name mydomain.org;
ssl_certificate /path/to/nginx.crt;
ssl_certificate_key /path/to/nginx.key;
location /doc/ {
alias /usr/share/doc/;
autoindex on;
allow 127.0.0.1;
allow ::1;
deny all;
}
location ~ ^(.+\.php)(.*)$ {
try_files $fastcgi_script_name =404;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
include /etc/nginx/fastcgi_params;
}
rewrite ^/.well-known/caldav /baikal/cal.php redirect;
rewrite ^/.well-known/carddav /baikal/card.php redirect;
charset utf-8;
location ~ /(\.ht|Core|Specific) {
deny all;
return 404;
}
}
Now, I simply want to restrict access to a subsubfolder called /my/data/ which I first added in the deny block like this:
location ~ /(\.ht|Core|Specific|my/data/) {
deny all;
return 404;
}
But this did not work out, so I defined an own location like:
location ~ /my/data {
deny all;
return 404;
}
Tried with and without trailing slash, with and without ~ like in /doc/ as well as putting the deny location block before any other one and now I am at a loss. Access to /my/data and all subfolders and files is still granted. Can anyone help me out?
Thanks for reading!

Answer 1

Location order is important if you are using locations with regular expressions, as locations given by regular expressions are checked in order and first matched wins. That is, a configuration like this:
location ~ \.php$ { fastcgi_pass ... }
location ~ /my/data { deny all; }
will always allow access to any .php files, even matching /my/data. To fix this, you have to maintain proper order of locations, i.e., keep location ~ /my/data first:
location ~ /my/data { deny all; }
location ~ \.php$ { fastcgi_pass ... }
Or, better yet, use prefix location with the ^~ modifier instead - in this case order will not be important. This also ensures that proper prefix matching will be used, and regular expressions won't be checked at all. E.g.:
location ~ \.php$ { fastcgi_pass ... }
location ^~ /my/data { deny all; }
See http://nginx.org/r/location for more details about location matching in nginx.
Note well that return 404 in your configuration is redundant if you use deny all, or vice versa. Just use one of the directives.
It's also important to note that when testing, you shouldn't rely on your browser. Testing with browser often leads to confusing results due to caching. It's better idea to use, e.g., curl.