Web2py & nginx - do I have to set up static folder - authentication

Question

I'm running nginx/uWSGI and trying to lock down a web2py site using 'auth.requires_login()' (https://groups.google.com/forum/#!topic/web2py/0j92-sPp4bc) so that only logged in users can get to it, even the content under /static/. If I set up nginx config file with
location ~* /(\w+)/static/ {
root /home/www-data/web2py/applications/;
}
as recommended in the docs, won't that bypass the access control, and allow anyone to see the static content? If I leave this line out of the config file, will web2py still share the static content to logged-in users (although presumably a little slower)?

Answer 1

Yes, using that nginx rule will bypass web2py. Removing it and letting web2py handle /static/ won't change much either, as this is directly from the web2py manual:
http://127.0.0.1:8000/a/static/filename
There is no controller called "static". web2py interprets this as a request for the file called "filename" in the subfolder "static" of the application "a".
When static files are downloaded, web2py does not create a session, nor does it issue a cookie or execute the models.
So because there is no controller, you cannot directly use auth.requires_login() for static content. This is because files in /static/ are generally not meant to be access-controlled, or else browsers will not be able to get the css, js, etc. needed to even render the welcome or login page.
However, if you still want site-wide access control to static files (i.e. private pdf files) you can do it like so:
in your application directory, create a folder called private_static
then in your controller add the following:
#default.py
import os
auth.requires_login()
def private_static():
filename = os.path.join(*request.args)
allowed = ['private1.pdf', 'private2.pdf'] # have some kind of validation for security!
if not filename in allowed:
raise HTTP(404)
return response.stream(open(os.path.join(request.folder, 'private_static', filename)))
and in your view something like the following:
Private Document
Now accessing http://.../private_static/private1.pdf will force the user to login before getting the static file.