how can I use external URI with the nginx's auth_request module

Question

I'm trying to use nginx's ngx_http_auth_request_module in such way:

server {

    location / {
        auth_request http://external.url;
        proxy_pass http://protected.resource;
    }
}

It doesn't work, the error is:

2017/02/21 02:45:36 [error] 17917#0: *17 open() "/usr/local/htmlhttp://external.url" failed (2: No such file or directory), ...

Or in this way with named location:

server {

    location / {
        auth_request @auth;
        proxy_pass http://protected.resource;
    }

    location @auth {
        proxy_pass http://external.url;
    }
}

In this case the error is almost the same:

2017/02/22 03:13:25 [error] 25476#0: *34 open() "/usr/local/html@auth" failed (2: No such file or directory), client: 127.0.0.1, server: , request: "GET / HTTP/1.1", subrequest: "@auth", host: "127.0.0.1"

I know there is a way like this:

server {

    location / {
        auth_request /_auth_check;
        proxy_pass http://protected.resource;
    }

    location /_auth_check {
        internal;
        proxy_pass http://external.url;
    }
}

But in this case the http://protected.resource can not use the /_auth_check path.

Is there a way to use an external URI as a parameter for the auth_request directive without overlapping the http://protected.resource routing?

If not, why?
It looks a little bit strange to look for the auth_request's URI through static files (/usr/local/html).

Answer 1

There is a little known fact that you don't have to start location with / or @.

So this would work:

location / {
    auth_request .auth;
    proxy_pass http://protected.resource;
}

location .auth {
    internal;
    proxy_pass http://external.url/auth;
    # you must use path part here ^
    # otherwise it would be invalid request to external.url
}