I have an nginx server block which serves as an authenticated origin pull CDN configuration.

Here is an excerpt from the block:

root "/vagrant/cdn-data";

fastcgi_intercept_errors on;

location /private/ {
    auth_request     /auth;
    auth_request_set $auth_status $upstream_status;
    try_files $uri @pull_file;
}

location @pull_file {
    root "/vagrant/cdn";
    fastcgi_pass    unix:/var/run/php/php7.4-fpm.sock;
    fastcgi_index   index.php;
    include         fastcgi.conf;
    fastcgi_param   EXPECTED_FILE "/vagrant/cdn-data$request_uri";
    fastcgi_param   API_DERIVATIVE_URL "https://api.mysite.local";
    fastcgi_param   SCRIPT_FILENAME $document_root/pull-file.php;
}

location = /auth {
    internal;
    proxy_pass              https://127.0.0.1:443/Access/Get;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
    proxy_set_header        X-Original-Uri $request_uri;
}

My problem is within the /private/ location. The example above will authenticate the request using the /auth proxy and on success it will proceed to try the file on $uri but if it is not found it will not proceed to @pull_file.

If I remove the auth_request and auth_request_set, try_files will first try $uri and if not found in this case will try the @pull_file location.

I am trying to achieve the following (successful scenario):

• the request is authenticated
• try the $uri (in this scenario the file will not exist)
• try the @pull_file (the fast cgi script will acquire the file, place it in the valid location and return the file)