No, I was thinking about the original auth_request. For cookies based authentication you need to turn off authorization for login pages (because every visitor s

No, I was thinking about the original auth_request. For cookies based authentication you need to turn off authorization for login pages (because every visitor should be allowed to access login pages) and pass login requests directly to your auth backend. The auth backend can then verify password, set cookies etc. auth_request failures 401, 403 can also be configured to show login page to the user. Here is a config that does something like this: https://github.com/wrr/wwwhisper/blob/master/nginx/wwwhisper.conf https://github.com/wrr/wwwhisper/blob/master/nginx/wwwhisper... (deployed here: https://io-mixedbit.rhcloud.com https://io-mixedbit.rhcloud.com) (Sorry for the late reply)