access_by_lua_block { if ngx.req.get_method() ~= "OPTIONS" and not ngx.var.http_authorization then ngx.exit(ngx.HTTP_UNAUTHORIZED) end }