Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

my PHP include:

    location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_index index.php;
            fastcgi_pass unix:/var/run/php5.socket;
            include /etc/nginx/fastcgi_params;
    }

I try to allow the access to files in a directory by location:

   location ~ /internal {
           allow IP;
           deny all;
   }

It works, but php files in this directory can be downloaded.

share|improve this question

2 Answers 2

Keep in mind that: Nginx always chooses only one location block to match a request. The search order is:

  1. =
  2. ^~
  3. None
  4. ~
  5. ~*
  6. @

so, a request /internal/foo.php is matched by the prefix location /internal first, then the search terminated and regular expression were not checked. It is why you get a download dialog when requesting PHP files.

To avoid duplicate, put the common directive into a separate file and use the include directive, something like this:

/etc/nginx/php.conf

try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_index index.php;
fastcgi_pass unix:/var/run/php5.socket;
include /etc/nginx/fastcgi_params;

/etc/nginx/nginx.conf

location /internal {
    allow IP;
    deny all;

    location ~ ^/internal(.*\.php)$ {
        include php.conf;
    }
}
location ~ \.php$ {
    include php.conf;
}
share|improve this answer

Try adding a php location for the inside of the /internal location, like:

location ~ /internal/\.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_index index.php;
            fastcgi_pass unix:/var/run/php5.socket;
            include /etc/nginx/fastcgi_params;
    }
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.