I want config.json to be readable by php app, but not via the browser

Question

Forgive me if this is a remedial question.

I'm authoring an API for a web app. I've got a config.json file for local configuration, but currently it can be called directly via a web browser if you know the URL.

If I change the permissions to be 750, php/nginx can't access it - causing 500 errors. It's also not feasible to put this file in a different dir that is not mapped to the directory structure under the nginx web root. (Owner of config.json is currently my linux user, but could be www-data - not sure it matters)

Is there a way to use linux owners/groups/permissions to solve this problem?

Answer 1

My 1st choice (given moving it outside the site root is not an option):

Define a location block in nginx with = and deny access.

location = /config.json {
    deny all;
}

Denying access will acknowledge the existence of the file. If you prefer, you could use return 404; instead of the deny all; line and it will look like the file doesn't even exist.

You should be able to make the file owned and readable by the php-fpm user but not the nginx user. However, I think this is too easy to get wrong and therefor too risky.

Otherwise:

This is why many php applications make their configuration files php files. If the browser were to request them, they would assemble some array of configurations and exit, outputting nothing. It's also common to check for some global variable inside the config file and exit silently returning nothing.