title: Magento can not access extension -> redirecting to admin login
body: <p>I have set up my new server with Nginx, Php-Fpm and APC. Also I am using an external Varnish Cache and MySQL Database.</p>
  
  <p>Since I am working with that setup one of my extensions stopped working. If I try to access it in the backend Magento logs me out and I am redirected to the magento admin login.</p>
  
  <p><strong>Here is my Nginx conf:</strong></p>
  
  <p>1.) nginx.conf</p>
  
  <pre><code>user              nginx;
  worker_processes  1;
  error_log         /var/log/nginx/error.log;
  pid               /var/run/nginx.pid;
  
  events {
      worker_connections  1024;
  }
  
  http {
      include       /etc/nginx/mime.types;
      default_type  application/octet-stream;
  
      log_format  main  '$remote_addr - $remote_user [$time_local] "$request "'
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for"';
  
      access_log  /var/log/nginx/access.log  main;
  
      sendfile        on;
      autoindex off;
      map $scheme $fastcgi_https { ## Detect when HTTPS is used
          default off;
          https on;
      }
  
      keepalive_timeout  10;
  
  
      gzip  on;
      gzip_comp_level 2;
      gzip_proxied any;
      gzip_types      text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
  
      # Load config files from the /etc/nginx/conf.d directory
      include /etc/nginx/conf.d/*.conf;
  </code></pre>
  
  <p>2.) domain.conf</p>
  
  <pre><code>server {
      listen 8080;
      server_name domain.de;
      rewrite / $scheme://www.$host$request_uri permanent; ## Forcibly prepend a www
  }
  
  server {
      listen 8080 default;
  # SSL directives might go here
      server_name www.domain.de *.domain.de; ## Domain is here twice so server_name_in_redirect will favour the www
      root /var/www/html;
  
      location / {
          index index.html index.php; ## Allow a static html file to be shown first
          try_files $uri $uri/ @handler; ## If missing pass the URI to Magento's front handler
          expires 30d; ## Assume all files are cachable
      }
  
      ## These locations would be hidden by .htaccess normally
     # location ^~ /app/                { deny all; }
     # location ^~ /includes/           { deny all; }
     # location ^~ /lib/                { deny all; }
     # location ^~ /media/downloadable/ { deny all; }
     # location ^~ /pkginfo/            { deny all; }
     # location ^~ /report/config.xml   { deny all; }
     # location ^~ /var/                { deny all; }
  
      location /var/export/ { ## Allow admins only to view export folder
          auth_basic           "Restricted"; ## Message shown in login window
          auth_basic_user_file htpasswd; ## See /etc/nginx/htpassword
          autoindex            on;
      }
  
      location  /. { ## Disable .htaccess and other hidden files
          return 404;
      }
  
      location @handler { ## Magento uses a common front handler
          rewrite / /index.php;
      }
  
      location ~ .php/ { ## Forward paths like /js/index.php/x.js to relevant handler
          rewrite ^(.*.php)/ $1 last;
      }
  location ~ .php$ { ## Execute PHP scripts
          if (!-e $request_filename) { rewrite / /index.php last; } ## Catch 404s that try_files miss
  
          expires        off; ## Do not cache dynamic content
          fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
          fastcgi_param  HTTPS $fastcgi_https;
          fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
          fastcgi_param  MAGE_RUN_CODE default;
          fastcgi_param  MAGE_RUN_TYPE store;
          include        fastcgi_params; ## See /etc/nginx/fastcgi_params
      }
  }
  </code></pre>
  
  <p><strong>The nginx error log tells me:</strong></p>
  
  <p>2013/05/27 21:07:01 [error] 18489#0: *4 access forbidden by rule, client: 54.xxx.x.xx, server: www.domain.de, request: "POST /app/etc/local.xml HTTP/1.1", host: "www.domain.de"</p>
  
  <p>Seems to me I have restricted the access somewhere. I already changed this:</p>
  
  <pre><code>## These locations would be hidden by .htaccess normally
     # location ^~ /app/                { deny all; }
     # location ^~ /includes/           { deny all; }
     # location ^~ /lib/                { deny all; }
     # location ^~ /media/downloadable/ { deny all; }
     # location ^~ /pkginfo/            { deny all; }
     # location ^~ /report/config.xml   { deny all; }
     # location ^~ /var/                { deny all; }
  </code></pre>
  
  <p>I am breaking my head over this. Does somebody has a tip for me where to look?</p>
  
  <p>Thanks in advance!</p>
  
  <p><strong>EDIT 1:</strong></p>
  
  <p><strong>Seems to me there is a mix up somewhere. If I delete listen: 8080; it works! Varnish Server (on :80) hands out an error message every twice attempt to enter the page (setup is ELB - Varnish - Nginx, normally), but basically I can access the extension. Is it possible that Varnish redirect it somehow?</strong></p>
  
  <p>This is the default.vcl</p>
  
  <pre><code>#
   backend default {
       .host = "xx.xxx.xxx.xx";
       .port = "8080"; # We will then configure apache to listen to port 8080
   }
  
  acl trusted {
      "127.0.0.1";
      "127.0.1.1";
      "xx.xxx.xxx.xx";
      # Add other ips that are allowed to purge cache
  }
  
  #
  # http://www.varnish-cache.org/docs/2.1/tutorial/vcl.html#vcl-recv
  # @param req    Request object
  sub vcl_recv {
      if (req.http.x-forwarded-for) {
          set req.http.X-Forwarded-For = req.http.X-Forwarded-For+","+client.ip;
      }
      else {
          set req.http.X-Forwarded-For = client.ip;
      }
  
      if (req.request == "PURGE") {
          # Allow requests from trusted IPs to purge the cache
          if (!client.ip ~ trusted) {
             error 405 "Not allowed.";
          }
          ban("req.url ~ " + req.url);
          error 200 "Ok"; #We don't go to backend
          #return(lookup); # @see vcl_hit
      }
  
      if (req.request != "GET" &amp;&amp;
         req.request != "HEAD" &amp;&amp;
         req.request != "PUT" &amp;&amp;
         req.request != "POST" &amp;&amp;
         req.request != "TRACE" &amp;&amp;
         req.request != "OPTIONS" &amp;&amp;
         req.request != "DELETE") {
           /* Non-RFC2616 or CONNECT which is weird. */
           return (pipe);
      }
  
       # Cache only GET or HEAD requests
       if (req.request != "GET" &amp;&amp; req.request != "HEAD") {
           /* We only deal with GET and HEAD by default */
           return (pass);
       }
  
      # parse accept encoding rulesets to normalize
  if (req.http.Accept-Encoding) {
          if (req.http.Accept-Encoding ~ "gzip") {
              set req.http.Accept-Encoding = "gzip";
          } elsif (req.http.Accept-Encoding ~ "deflate") {
              set req.http.Accept-Encoding = "deflate";
          } else {
              # unkown algorithm
              remove req.http.Accept-Encoding;
          }
      }
  
       # Rules for static files
       if (req.url ~ "\.(jpeg|jpg|png|gif|ico|swf|js|css|gz|rar|txt|bzip|pdf)(\?.*|)$") {
          set req.http.staticmarker = "1";
          unset req.http.Cookie;
  
          return (lookup);
      }
  
      # Don't cache pages for Magento Admin
      # change this rule if you use custom url in admin
      if (req.url ~ "^/(index.php/)?admin") {
          return(pass);
      }
  
      # Don't cache checkout/customer pages, product compare
      if (req.url ~ "^/(index.php/)?(checkout|customer|catalog/product_compare|wishlist)") {
          return(pass);
      }
  
      # Don't cache till session end
      if (req.http.cookie ~ "nocache_stable") {
          return(pass);
      }
  
      # Unique identifier witch tell Varnish use cache or not
      if (req.http.cookie ~ "nocache") {
          return(pass);
      }
  
      # Remove cookie
      unset req.http.Cookie;
      set req.http.magicmarker = "1"; #Instruct varnish to remove cache headers received from backend
      return(lookup);
   }
  
  sub vcl_pipe {
  #     # Note that only the first request to the backend will have
  #     # X-Forwarded-For set.  If you use X-Forwarded-For and want to
  #     # have it set for all requests, make sure to have:
  #     # set req.http.connection = "close";
  #     # here.  It is not set by default as it might break some broken web
  #     # applications, like IIS with NTLM authentication.
       return (pipe);
  }
  
  #sub vcl_pass {
  #     return (pass);
  #}
  
  #sub vcl_hash {
  #     set req.hash += req.url;
  #     if (req.http.host) {
  #         set req.hash += req.http.host;
  #     } else {
  #         set req.hash += server.ip;
  #     }
  #     return (hash);
  # }
  
  # Called after a cache lookup if the req. document was found in the cache.
  sub vcl_hit {
      if (req.request == "PURGE") {
          ban_url(req.url);
          error 200 "Purged";
      }
  
      if (!(obj.ttl &gt; 0s)) {
          return (pass);
      }
      return (deliver);
  }
  
  # Called after a cache lookup and odc was not found in cache.
  sub vcl_miss {
      if (req.request == "PURGE"){
          error 200 "Not in cache";
      }
      return (fetch);
  }
  
  # Called after document was retreived from backend
  # @var req      Request object.
  # @var beresp   Backend response (contains HTTP headers from backend)
  sub vcl_fetch {
      set req.grace = 30s;
  
      # Current response should not be cached
      if(beresp.http.Set-Cookie ~ "nocache=1") {
          return (deliver);
      }
  
      # Flag set when we want to delete cache headers received from backend
      if (req.http.magicmarker){
          unset beresp.http.magicmarker;
          unset beresp.http.Cache-Control;
          unset beresp.http.Expires;
          unset beresp.http.Pragma;
          unset beresp.http.Cache;
          unset beresp.http.Server;
          unset beresp.http.Set-Cookie;
          unset beresp.http.Age;
  
          # default ttl for pages
          set beresp.ttl = 1d;
      }
      if (req.http.staticmarker) {
          set beresp.ttl = 30d; # static file cache expires in 30 days
          unset beresp.http.staticmarker;
          unset beresp.http.ETag; # Removes Etag in case we have multiple frontends
      }
  
      return (deliver);
  }
  
  # Called after a cached document is delivered to the client.
  sub vcl_deliver {
      if (obj.hits &gt; 0) {
          set resp.http.X-Cache = "HIT ("+obj.hits+")";
      } else {
          set resp.http.X-Cache = "MISS";
          #    set resp.http.X-Cache-Hash = obj.http.hash;
      }
      return (deliver);
  }
  </code></pre>