Forgive me if this is a remedial question.

I'm authoring an API for a web app. I've got a config.json file for local configuration, but currently it can be called directly via a web browser if you know the URL.

If I change the permissions to be 750, php/nginx can't access it - causing 500 errors. It's also not feasible to put this file in a different dir that is not mapped to the directory structure under the nginx web root. (Owner of config.json is currently my linux user, but could be www-data - not sure it matters)

Is there a way to use linux owners/groups/permissions to solve this problem?

  • You could deny access to any file ending with .json. Use a regular expression location block. – Richard Smith Oct 29 '18 at 18:13

My 1st choice (given moving it outside the site root is not an option):

Define a location block in nginx with = and deny access.

location = /config.json {
    deny all;

Denying access will acknowledge the existence of the file. If you prefer, you could use return 404; instead of the deny all; line and it will look like the file doesn't even exist.

You should be able to make the file owned and readable by the php-fpm user but not the nginx user. However, I think this is too easy to get wrong and therefor too risky.


This is why many php applications make their configuration files php files. If the browser were to request them, they would assemble some array of configurations and exit, outputting nothing. It's also common to check for some global variable inside the config file and exit silently returning nothing.

  • Yeah - i thought about making the config a PHP file...it's just that I have a webform handled by a PHP script that creates the standard form config, that outputs JSON with each save. I suppose i could wrap the whole JSON blob in PHP. I don't love the idea of relying on NGINX config to secure the file either. – andrewniesen Oct 29 '18 at 19:41

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.