skip to Main Content

I’m using NGINX on Centos 7.
I blocked all PHP request because my web server has only static html files.
My NGINX configuration is like below;

server {
listen myIp:80;
server_name myDomain;

location ~(.php$) {
    return 403;
}

return 301 https://myDomain$request_uri;

}

but it returns 301 for requests for index.php. my access.log like below;

43.226.148.141 - - [23/Feb/2020:04:36:54 +0900] "GET /mysql/admin/index.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" "-"

I expected NGINX will return 404 because index.php does not exist or return 403 because I added restrictions but in access.log it returned 301.
And when I try it by inputting ‘myDomain/mysql/admin/index.php’ on a web browser then I get 403 after 301.

Can anyone please explain what’s happening on my NGINX server and help me fix this problem?

2

Answers


  1. The location ~(.php$) { doesn’t match because it’s missing a space between ~ and regular expression itself. Moreover, there is no need to create a capture group. Thus, better:

    location ~ .php$ {
        return 403;
    }
    
    Login or Signup to reply.
  2. The return 301 will be always executed even if the locations match since it is not scoped in a specific location. Try to rewrite the Nginx configs like it is shown below

    location ~ .php$ {
      return 403;
    }
    
    location / {
      return 301 https://myDomain$request_uri;
    }
    
    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search