here is on option with auth basic. that is what i use. each location you want to handle with restriction needs to enclosed in "location /". other locations can be outside for setting headers etc etc.

I did search the same thing long ago but made own solution for it.

server {
    listen 80;
    server_name completerespite.com;
    return 301 http://www.completerespite.com$request_uri;
}
server {
    listen 80;
    server_name www.completerespite.com;
    # --------------------------------------------------------------------------
    # Locations
    # --------------------------------------------------------------------------
    location / {
        proxy_pass http://yourdomain;
        # set headers
        # ...
        location ~ /web/database/manager {
            auth_basic "Restricted Access";
            auth_basic_user_file auth/domain_auth;
            proxy_pass http://yourdomain;
            # set headers
            # ...
        }
        location ~ /web/database/selector {
            auth_basic "Restricted Access";
            auth_basic_user_file auth/domain_auth;
            proxy_pass http://yourdomain;
            # set headers
            # ...
        }
    }
}

send images, etc without cookies header... same level with 'location /' like mentioned above. handles the multilang paths!

location ~* /web/static/ {
        access_log off;
        log_not_found off;
        expires 10d;
        proxy_cache_valid 200 60m;
        proxy_buffering on;
        proxy_hide_header Set-Cookie;
        proxy_ignore_headers Set-Cookie;
        proxy_pass http://hexon_fi;
    }