--- a/ngx_http_auth_request_module.c
+++ b/ngx_http_auth_request_module.c
@@ -159,6 +159,7 @@ ngx_http_auth_request_handler(ngx_http_r
         return NGX_ERROR;
     }
 
+    sr->discard_body = 1;
     sr->header_only = 1;
 
     ctx->subrequest = sr;

--- a/t/auth-request.t
+++ b/t/auth-request.t
@@ -9,6 +9,8 @@
 use warnings;
 use strict;
 
+use Socket qw/ CRLF /;
+
 use Test::More;
 use Test::Nginx;
 
@@ -18,7 +20,7 @@ select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
 my $t = Test::Nginx->new()->has(qw/http rewrite proxy fastcgi auth_basic/)
-	->plan(14);
+	->plan(17);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -83,6 +85,8 @@ http {
         }
         location = /auth-proxy {
             proxy_pass http://127.0.0.1:8080/auth-basic;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
         }
         location = /auth-basic {
             auth_basic "restricted";
@@ -94,6 +98,7 @@ http {
         }
         location = /auth-fastcgi {
             fastcgi_pass 127.0.0.1:8081;
+            fastcgi_pass_request_body off;
         }
     }
 }
@@ -115,6 +120,9 @@ like(http_get('/forbidden'), qr/ 403 /, 
 like(http_get('/error'), qr/ 500 /, 'auth error');
 like(http_get('/off'), qr/ 404 /, 'auth off');
 
+like(http_post('/open'), qr/ 404 /, 'auth post open');
+like(http_post('/unauthorized'), qr/ 401 /, 'auth post unauthorized');
+
 like(http_get('/open-static'), qr/ 404 /, 'auth open static');
 unlike(http_get('/open-static'), qr/INVISIBLE/, 'auth static no content');
 
@@ -124,6 +132,8 @@ like(http_get('/proxy'), qr/WWW-Authenti
 like(http_get_auth('/proxy'), qr/ 404 /, 'proxy auth pass');
 unlike(http_get_auth('/proxy'), qr/INVISIBLE/, 'proxy auth no content');
 
+like(http_post('/proxy'), qr/ 401 /, 'proxy auth post');
+
 SKIP: {
 	eval { require FCGI; };
 	skip 'FCGI not installed', 2 if $@;
@@ -147,6 +157,18 @@ Authorization: Basic dXNlcjpzZWNyZXQ=
 EOF
 }
 
+sub http_post {
+	my ($url, %extra) = @_;
+
+	my $p = "POST $url HTTP/1.0" . CRLF .
+		"Host: localhost" . CRLF .
+		"Content-Length: 10" . CRLF .
+		CRLF .
+		"1234567890"; 
+
+	return http($p, %extra);
+}
+
 ###############################################################################
 
 sub fastcgi_daemon {