4

I read and followed this question in order to configure nginx to force SSL for one page (admin.php for XenForo), and it is working well for a few of the site administrators but is not for myself. I was wondering if anyone has any advice on how to improve this configuration:

...

ssl_certificate      example.net.crt;
ssl_certificate_key  example.key;

server {
    listen 80 default;
    listen 443 ssl;

    server_name www.example.net example.net;
    access_log /srv/www/example.net/logs/access.log;
    error_log /srv/www/example.net/logs/error.log;

    root /srv/www/example.net/public_html;

    location / {
        if ( $scheme = https ){
            return 301 http://example.net$request_uri;
        }
        try_files $uri $uri/ /index.php?$uri&$args;
        index index.php index.html;
    }

    location ^~ /admin.php {
        if ( $scheme = http ) {
            return 301 https://example.net$request_uri;
        }
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
    }

    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

...

It seems that the extra information in the location ^~ /admin.php block is unecessary, does anyone know of an easy way to avoid duplicate code? Without it it skips the php block and just returns the php files.

Currently it applies https correctly in Firefox when I navigate to admin.php. In Chrome, it downloads the admin.php page. When returning to the non-https website in Firefox, it does not correctly return to http but stays as SSL. Like I said earlier, this only happens for me, the other admins can go back and forth without a problem.

Is this an issue on my end that I can fix? And does anyone know of any ways I could reduce duplicate configuration options in the configuration? Thanks in advance!

EDIT: Clearing the cache / cookies seemed to work. Is this the right way to do http/https redirection? I sort of made it up as I went along.

0

ways I could reduce duplicate configuration options in the configuration

Possibly using @-named location. See doc.

0

This could be related to a bug explained here https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/

What I recommend you to use are specific HTTP/HTTPS blocks, for example

server {
  listen 80;
  server_name www.example.net example.net;

  return 301 https://$server_name$request_uri;
}
server {
  listen 443 ssl;

  server_name www.example.net example.net;
  access_log /srv/www/example.net/logs/access.log;
  error_log /srv/www/example.net/logs/error.log;

  root /srv/www/example.net/public_html;

  location / {
    try_files $uri $uri/ /index.php?$uri&$args;
    index index.php index.html;
  }

  location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000;
        fastcgi_param SCRIPT_FILENAME 
        $document_root$fastcgi_script_name;
        }
  }

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.