10000 NGINX Configuration · Issue #6005 · symfony/symfony-docs · GitHub
[go: up one dir, main page]
Skip to content

NGINX Configuration #6005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
peterrehm opened this issue Dec 12, 2015 · 6 comments
Closed

NGINX Configuration #6005

peterrehm opened this issue Dec 12, 2015 · 6 comments
Labels
hasPR A Pull Request has already been submitted for this issue. Waiting feedback

Comments

@peterrehm
Copy link
Contributor

If I understand the configuration correctly according to this document http://symfony.com/doc/current/cookbook/configuration/web_server_configuration.html#nginx

The server will not pass e.g. app_dev.php to php5-fpm but it will download the source instead. If that is confirmed shouldn't the recommended configuration for the prod environment be that no other php file can be executed and will be e.g. forwarded to app.php?
@xabbuh
Copy link
Member
xabbuh commented Dec 12, 2015

Well, some lines above we tell you that you should neither deploy app_dev.php nor config.php to your prod environment. Do you have an idea how we can put more emphasize on this?

@peterrehm
Copy link
Contributor Author

I see the issue that most people checkout their repository and forget to remove those files. We could add some config redirecting app_*.php and config.php.

@xabbuh
Copy link
Member
xabbuh commented Dec 12, 2015

Can we somehow simply trigger a 404 status code? This way we would also leak less information.

@peterrehm
Copy link
Contributor Author

Ill look into that, I would expect it should not be a big deal.

@peterrehm peterrehm mentioned this issue Dec 13, 2015
Closed
@peterrehm
Copy link
Contributor Author

Just provided an easy solution.

@xabbuh xabbuh added the hasPR A Pull Request has already been submitted for this issue. label Dec 13, 2015
@richardjennings
Copy link

I have also found the example Nginx configuration to be a liability for the reasons mentioned here. Any .php file that exists in web/ in production other than app.php will be served as a static file. I would suggest that this caveat is at least mentioned in the documentation.

weaverryan added a commit that referenced this issue May 22, 2016
@weaverryan
security #6008 Improved nginx config to not expose other php files (p…
90a2922 
…eterrehm)

This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes #6008).

Discussion
----------

Improved nginx config to not expose other php files

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | all
| Fixed tickets | #6005

This should improve the security as all non defined php files will return
a 404 error code instead of providing them as text which is a more sane
solution.

Commits
-------

6545884 Updated according to comments
31a13cb Improved nginx config to not expose other php files
@wouterj wouterj closed this as completed Jul 8, 2016
@wouterj wouterj mentioned this issue Aug 3, 2016
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
hasPR A Pull Request has already been submitted for this issue. Waiting feedback
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@javiereguiluz @richardjennings @wouterj @xabbuh @peterrehm
0