Nginx configuration to deny access to private Laravel folders - laravel

Every answer or tutorial about nginx configuration on Laravel has something like that:
location ~ \.php {
# fastcgi stuff ...
}
If the Laravel framework has a unique entry point (the public index.php), wouldn't it be this definition more accurate?
location ~ index\.php {
# fastcgi stuff ...
}
In a context where you have your app deployed on a subfolder, the first configuration it's allowing the access on every php private file, even if I have already defined a deny all rule over the private folder.
I'm wrong with anything?
There is another way to define a fully deny access over a folder?

If you want deny access to files in your private folder (e.g. /private) add this to your config for virtual host:
Case sensitive
location ~ ^/private/(.*)\.php$ {
deny all;
}
Case insensitive:
location ~* ^/private/(.*)\.php$ {
deny all;
}
This returns 403 all requests to /private/something.php, /private/something/something.php and so on. But requests to /private/something will work.

Related

WordPress and YOURLS on one domain (Nginx)

I want to run both WordPress and YOURLS on one domain.
Since both need to handle URLs differently, they need different try_files directives. WordPress sits on the root of the domain (domain.tld), while YOURLS is being installed to the /go/ directory.
Despite the two location rules, I get 404s on any links generated by YOURLS (e.g. domain.tld/g/linkname, all are redirects to external URLs), though I can access the YOURLS admin backend.
As far as I read, declaring to location rules (one for /go/, and one for /) should suffice in order to let Nginx handle the direct and the /go/ URLS differently - is there something in wrong in my thinking?
I have added the following to the Nginx config:
location / {
try_files $uri $uri/ /index.php?$args;
}
location /go/ {
try_files $uri $uri/ /go/yourls-loader.php$is_args$args;
}
What am I missing?
Not sure if it will be of direct help to you or not.
I was trying to do a similar configuration using a subdirectory pointing to yourls docker
After many hits and trials, the following settings have worked for me. Maybe some part of it might be useful for someone.
location ~ (\/shorturl\/.*) {
if ( $uri ~ ^\/shorturl\/((admin|images|js|css)(\/?)(.*)|.*.(\.html|\.php)) ) {
rewrite /shorturl(/?)(.*) $1$2 break;
}
rewrite (\/shorturl\/.*) $1 break;
proxy_pass http://localhost:9091;
proxy_redirect / /shorturl/;
}
PS: I know if is evil and please add proxy headers as per your need!

Unable to boot ApiServiceProvider, configure an API domain or prefix in Laravel

I am using Laravel-8 as restful api. Also I am using Dingo Package. Initially the url was:
http://localhost:8888/myapp/server/public
And it was loading correctly.
However, I decided to remove public from the url. So I followed these steps:
Rename server.php in your Laravel root folder to index.php
Copy the .htaccess file from /public directory to your Laravel root folder.
When I tried to reload the url as:
http://localhost:8888/myapp/server
I got this error:
Unable to boot ApiServiceProvider, configure an API domain or prefix
C:\xampp\htdocs\myapp\server\vendor\dingo\api\src\Provider\DingoServiceProvider.php
protected function registerConfig()
{
$this->mergeConfigFrom(realpath(__DIR__.'/../../config/api.php'), 'api');
if (! $this->app->runningInConsole() && empty($this->config('prefix')) && empty($this->config('domain'))) {
throw new RuntimeException('Unable to boot ApiServiceProvider, configure an API domain or prefix.');
}
}
Even with:
http://localhost:8888/mygeapp/server/public/
The same error still applies
How do I resolve this?
Thanks
Please be sure to configure your IPI PREFIX in the env file
API_PREFIX=api

Laravel + Nginx: can we serve app from /something and from a different folder?

On disk
/var/www/mainapp -> some other legacy .php files without any magic url handling
/var/www/laravel - > my laravel app
I must serve
accessing domain.tld -> mainapp
accessing domain.tld/laravel -> my laravel app
The problem is also that Laravel's app are entirelyt served from /var/www/laravel/public/index.php as you of course know
I am not able to set nginx to serve /laravel and all subroutes using laravel app
Something as simple as this should work:
server {
server_name domain.tld;
location / {
root /var/www/mainapp;
# add php/fpm config
}
location /laravel {
root /var/www/laravel;
# add php/fpm config
}
}

Can PhpStorm debug a file that has been redirected to using Nginx's X-Accel-Redirect?

I'm using Nginx's X-Accel-Redirect to serve a file (redirected.php) that is outside of the webroot. The webroot is /usr/share/nginx/html and the file I am wanting to debug is being served from /usr/share/nginx/downloads
I begin Xdebug in the browser (debugging works at this stage). At some point the browser makes a request for website1.com/learning/downloads/url,
Nginx redirects the request to redirected.php using the below rule
# Enable X-Accel-Redirect
location /learning/downloads/ {
root /usr/share/nginx/downloads;
rewrite ^/(.*)$ /redirected.php last;
}
Unfortunately, I can't get redirected.php to pause on any breakpoints.
Is it not possible to debug when using X-Accel-Redirect with PhpStorm? or is it more likely to be a mapping issue? Suggestions on how to overcome this issue would be much appreciated.
It was a mapping issue. Part of the problem was due to redirected.php being in a folder outside the webroot.
To fix it, I went to File -> Settings -> Languages & Frameworks -> PHP -> Servers and configured it as in the picture below.
I also added xdebug_break(); to the code in redirected.php

proper way to manage images and static files nginx

I'm a new coming to nginx service, I misunderstand how nginx manage the files to do show.
Let's say an example. In my web application I have statics file with this path:
---public
| -- js
| -- img
| -- css
For invoke this kind of static files it just need to digit the current url: www.mysite.com/js/some.js or www.mysite.com/img/myimg.jpg that's fine it will show up.
But now let's say I have a script on my php files that use a different url to get a image from public/img folder using example www.mywebsite.com/20/10/29/myimg.jpg
if I add this code to my configuration in nginx, it will get correctly all files to serve to my application giving of course a real path of the file
location ~* \.(jpe?g|gif|png|ico|css|js|html|htm|woff|svg|ttf)$ {
access_log off;
expires max;
}
Getting the previous example with the url that generate the image, if I use that block of code in nginx and i try to go:
www.mywebsite.com/20/10/29/myimg.jpg
The image will displayed correctly because i show it via php, but on the console log the image get a 404 because nginx go to search for the file with extension jpg on public/20/10/29/myimg.jpg even if the file is on the public/img folder it make sense.
My question is, some one can explain to me how nginx logic has been created for serve static files and files via dynamic url?
Proper way is to get rid of awful block location ~* (...) and use simple prefix locations.
location /img/ {
access_log off;
expires max;
}
location /js/ {
access_log off;
expires max;
}
location /css/ {
access_log off;
expires max;
}

Resources