It was unintuitive and the nginx doc doesn’t put it clearly, http://nginx.org/en/docs/http/ngx_http_core_module.html#location.

for nested blocks, for example

location /protected {
access_by_lua_block {
local opts = {
redirect_uri = "/auth_redirect",
...
use_nonce = true
}
...
}
default_type text/html;
content_by_lua 'ngx.say("<p>Protected</p>")';
location /protected/api {
...
}
location /auth {
...
}
...
}

the URL, http://{hostname}/protected/auth wont work

while at the same time, the URL http://{hostname}/protected/api would direct correctly.

as the nested location is still following the same pattern or prefix matching, without any url concatenation.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store