NGINX basic auth only for POST
You should use limit_except:
limit_except GET HEAD {
auth_basic 'Restricted';
auth_basic_user_file /path/to/userfile;
}
It works since nginx 0.8.48, in older versions there was a bug where fastcgi_pass was not inherited inside the limit_except block.