It was unintuitive and the nginx doc doesn’t put it clearly, http://nginx.org/en/docs/http/ngx_http_core_module.html#location.
for nested blocks, for example
location /protected {
access_by_lua_block {
local opts = {
redirect_uri = "/auth_redirect",
...
use_nonce = true
}
...
}
default_type text/html;
content_by_lua 'ngx.say("<p>Protected</p>")';
location /protected/api {
...
} location /auth {
...
}
...
}
the URL, http://{hostname}/protected/auth wont work
while at the same time, the URL http://{hostname}/protected/api would direct correctly.
as the nested location is still following the same pattern or prefix matching, without any url concatenation.
