Is there any advantage using:
location ~ \.php {
location ~ \..*/.*\.php$ {
return 403;
}
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_intercept_errors on;
}
Compared to
location ~ \..*/.*\.php$ {
return 403;
}
location ~ \.php {
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
fastcgi_intercept_errors on;
}
I would like to avoid arbitrary code execution that is shown here: https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/#passing-uncontrolled-requests-to-php
In my simple browser test domain/somedir/file.jpg/1.php
it returns 403
in both ways, but I'm still not sure if this is all security I need. Also, if there is any difference in "performance".