deny all not preventing return redirection

Question

Nginx is behaving unexpectedly for me. Here are two simplified location blocks.

This works as expected. Returns 403 error:

location / {
    deny all;
    root /var/www/test;
}

I expected a 403 error. However, this returns 301 and redirects:

location / {
    deny all;
    return 301 https://$server_name$request_uri;
}

How can I deny and prevent any url redirection with return directive?

Answer 1

In nginx, return directive is from rewrite module, and deny is from access module. According to nginx document and source code, rewrite module is processed in NGX_HTTP_REWRITE_PHASE phase (for return in location context), the access module is processed in NGX_HTTP_ACCESS_PHASE phase, rewrite phase happens before access phase, thus return stops request processing and returns 301 in rewrite phase.