0

I have a prestashop site which is all in SSL. The problem I have is that the paymemnt gateway return is unable to do it with SSL, so I have to create an exception on my nginx config to accept the callback url with HTTP.

Here is what I tried (with no luck):

server {
  listen 80;

  server_name example.com www.example.com;
  client_header_buffer_size 16k;
  large_client_header_buffers 16 16k;

  root /var/www/html/example.com;

  location / {  # the default location redirects to https
    return 301 https://$server_name$request_uri;
  }

  location ~ /validation.php$ {  # chapuza per redsys
    include       fastcgi.conf;
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_script_name;
    fastcgi_buffer_size 32k;
    fastcgi_buffers 4 32k;
    fastcgi_read_timeout 300;
  }


}

server {
  listen 443 ssl;
  listen [::]:443 ssl;
  include snippets/ssl-example.com.conf;
  include snippets/ssl-params.conf;

  server_name example.com www.example.com;

  ssl on;

  #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;


  root /var/www/html/example.com;

  # Try static files first, then php
  index index.html index.htm index.php;

  #Specify a charset
  charset utf-8;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 1;
    gzip_buffers 16 8k;
    gzip_http_version 1.0;
    gzip_types application/json text/css application/javascript;

  location ~ /validation.php$ {  # chapuza per redsys
    return 301 http://$server_name$request_uri;
  }

  rewrite ^/api/?(.*)$ /webservice/dispatcher.php?url=$1 last;

  rewrite ^/([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$1$2$3.jpg last;
  rewrite ^/([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$1$2$3$4.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$1$2$3$4$5.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$4/$1$2$3$4$5$6.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$4/$5/$1$2$3$4$5$6$7.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$1$2$3$4$5$6$7$8.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$1$2$3$4$5$6$7$8$9.jpg last;
  rewrite ^/([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])([0-9])(\-[_a-zA-Z0-9-]*)?(-[0-9]+)?/.+\.jpg$ /img/p/$1/$2/$3/$4/$5/$6/$7/$8/$1$2$3$4$5$6$7$8$9$10.jpg last;

  rewrite ^/order$ /index.php?controller=order last;

  if (!-e $request_filename){
    rewrite ^(.*)$ /index.php last;
  }

  # Redirect needed to "hide" index.php
  location / {
    try_files $uri $uri/ /index.php?q=$uri&$args;
  }

  location /c {
    rewrite ^/c/([0-9]+)(\-[\.*_a-zA-Z0-9-]*)(-[0-9]+)?/.+\.jpg$ /img/p/$1$2$3.jpg last;
    rewrite ^/c/([a-zA-Z_-]+)(-[0-9]+)?/.+\.jpg$ /img/p/$1$2.jpg last;
  }

  location /p {
    rewrite ^/p/([0-9]+)(\-[\.*_a-zA-Z0-9-]*)(-[0-9]+)?/.+\.jpg$ /img/p/$1$2$3.jpg last;
    rewrite ^/p/([a-zA-Z_-]+)(-[0-9]+)?/.+\.jpg$ /img/p/$1$2.jpg last;
  }

  location /images_ie {
    rewrite ^/images_ie/?([^/]+)\.(jpe?g|png|gif)$ /js/jquery/plugins/fancybox/images/$1.$2 last;
  }


  # Don't log robots.txt or favicon.ico files
  location ~* ^/(favicon.ico|robots.txt)$ {
    access_log off;
    log_not_found off;
  }
  # Custom 404 page
  error_page 404 /index.php?controller=404;

#  location ~* ^.+.(gif|jpg|jpeg|png|wmv|avi|mpg|mpeg|mp4|htm|html|js|css|mp3|swf|ico|flv|xml) {
#    access_log off;
#    expires 30d;
#  }

  # Deny access to .htaccess
  location ~ /\.ht {
    deny all;
  }

  location ~ /.well-known {
       allow all;
  }

  # PHP scripts -> PHP-FPM server listening on 127.0.0.1:9000
  location ~ \.php$ {
    include       fastcgi.conf;
    fastcgi_pass  127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_script_name;
    fastcgi_buffer_size 32k;
    fastcgi_buffers 4 32k;
    fastcgi_read_timeout 300;
  }



}

the callback which is /example/test_dir/validation.php goes into a loop

Where is my error?

Thanks

3
  • What exactly is the URL for the payment gateway script? Apr 3, 2017 at 20:30
  • Try "location = /validation.php". In Nginx the most specific location match is the one chosen. Check the "location block syntax" section of this page digitalocean.com/community/tutorials/…
    – Tim
    Apr 3, 2017 at 20:48
  • You may want to consider what data is present in the redirect, and see if anything can be done to try and secure it - on the face of it, I am seeing 'payment gateway', 'validation.php', and plaintext, and that seems like a bad combination of things Apr 9, 2017 at 9:34

1 Answer 1

0

The issue is here:

location \.validation.php$ {  # chapuza per redsys

You have a regular expression syntax here, except you are missing the ~ to indicate that it should be interpreted as regular expression.

Use

location ~ \.validation\.php$ {  # chapuza per redsys

instead.

Then, you are sending out the HSTS header in your https location, which tells clients that all requests to the domain must be made with https. This isn't an issue if the URL is only accessed by a client that does not care about HSTS.

I recommend that you find a payment solution that uses https with its transactions.

8
  • Thanks for your reply. I tried, but still goes to HTTPS. I'll like to have a payment gateway with https, but I cannot choose my bank uses redsys as solution, which have an old version of java Apr 3, 2017 at 14:07
  • How are you testing that it goes to HTTPS? I added one escape character to the regex, which means that only a dot is allowed before php in the regex. Apr 3, 2017 at 15:52
  • I test by putting the url of the valition.php with http and it redirects to https, if I put with https it stays in https Apr 3, 2017 at 16:38
  • Should I remove the add_header Strict-Transport-Security "max-age=31536000"; line? Apr 3, 2017 at 17:38
  • If you want to use that resource with a browser, then you need to remove HSTS header, which forces browser to load the page with https. You need to also clear browser cache. If you don't need to use with a browser, use a HTTP diagnostics tool like curl to check that the solution is working correctly. Apr 3, 2017 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .