I’m using NGINX on Centos 7.
I blocked all PHP request because my web server has only static html files.
My NGINX configuration is like below;
server {
listen myIp:80;
server_name myDomain;
location ~(.php$) {
return 403;
}
return 301 https://myDomain$request_uri;
}
but it returns 301 for requests for index.php. my access.log like below;
43.226.148.141 - - [23/Feb/2020:04:36:54 +0900] "GET /mysql/admin/index.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" "-"
I expected NGINX will return 404 because index.php does not exist or return 403 because I added restrictions but in access.log it returned 301.
And when I try it by inputting ‘myDomain/mysql/admin/index.php’ on a web browser then I get 403 after 301.
Can anyone please explain what’s happening on my NGINX server and help me fix this problem?
2
Answers
The
location ~(.php$) {
doesn’t match because it’s missing a space between~
and regular expression itself. Moreover, there is no need to create a capture group. Thus, better:The return 301 will be always executed even if the locations match since it is not scoped in a specific location. Try to rewrite the Nginx configs like it is shown below