Blocking access to `*.php` in `.well-known`

Question

I would like to modify an existing Nginx location block to serve an HTTP 403 status to any PHP files in the .well-known directory and its subdirectories. I am using .well-known for legitimate purposes, but a recent server compromise has shown I need to be a lot more strict on what's permitted.

My current Nginx location block is:

    location ^~ /.well-known/ {
        allow all;
        default_type "text/plain";
        root /var/www/example.com/_well-known/;
        try_files $uri/ $uri =404;
    }

The root is deliberately outside the public HTML directory (which is at /var/www/example.com/live/ if it's relevant).

How can I modify this block or provide an additional location block to serve HTTP 403 to all PHP file requests under the .well-known directory?

Thank you.

Answer 1

You need a regular expression location block to match URLs that end with .php.

The ^~ operator on the current location block means that this new regular expression location block must be nested within the existing block.

For example:

location ^~ /.well-known/ {
    allow all;
    default_type "text/plain";
    root /var/www/example.com/_well-known/;
    try_files $uri/ $uri =404;

    location ~* \.php$ { return 403; }
}

Any URL that begins with /.well-known/ and ends with .php will result in a 403 status.

Answer 2

You could to use nested locations like this:

location ^~ /.well-known/ {
    . . .
    location ~ \.php$ {
        deny all;
    }
}

...although the documentation suggests this should fail:

location blocks can be nested, with some exceptions mentioned below.

If the longest matching prefix location has the “^~” modifier then regular expressions are not checked.

Another option would be to remove the ^~ modifier and add a regex location that matches .php in /.well-known/.

location /.well-known/ {
    . . .
}

location ~ ^/.well-known/.*\.php$ {
    deny all;
}

location ~ \.php$ {
    . . .
}

Answer 3

To modify your existing Nginx configuration to serve an HTTP 403 status to any PHP files in the .well-known directory and its subdirectories, you can add an additional location block within the existing one to handle PHP files specifically. Here is the updated configuration:

    location ^~ /.well-known/ {
    allow all;
    default_type "text/plain";
    root /var/www/example.com/_well-known/;
    try_files $uri/ $uri =404;

    # Deny access to PHP files
    location ~* \.php$ {
        deny all;
    }
}