Nginx "allow 127.0.0.1" in location block letting in all users

Question

Problem

I have the following block in my nginx config.

The idea is to let the server access the file but noone else. If anyone else accesses i it should throw a 403. If I comment out the allow line this is what happens. However if I leave it in anyone can access it.

What am I doing wrong?

location = /update.php {
       allow 127.0.0.1;
       deny all;
       fastcgi_param SCRIPT_FILENAME /srv/www/mysite/public$fastcgi_script_name;
       fastcgi_pass 127.0.0.1:9000;
       include /etc/nginx/fastcgi_params;
   }

Answer 1

Try like this.

error_page 403 http://yourdomain.tld/403page.htm;
location /update.php {
  allow <your-server-ip>;
  fastcgi_param SCRIPT_FILENAME /srv/www/mysite/public$fastcgi_script_name;
  fastcgi_pass 127.0.0.1:9000;
  include /etc/nginx/fastcgi_params;
  deny all;
}