We're working across two sites and the only way I can reach our nginx server is via an SSH tunnel, mapping port 9097 to 443. We use this regularly and I'm confident in it. The nginx server is serving php pages via fastcgi. I can issue HTTP GET requests to the api through the tunnel, but when I try to run a POST request I just get a time out. If I ssh to the same side, so I can use the url the server expects, the POST request works. I'm not sure if I'm passing the correct values through the fastcgi_params, (shown below, taken from the nginx website, https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/). I've tried changing the server_name to $http_host, but no joy.

fastcgi_param   QUERY_STRING            $query_string;
fastcgi_param   REQUEST_METHOD          $request_method;
fastcgi_param   CONTENT_TYPE            $content_type;
fastcgi_param   CONTENT_LENGTH          $content_length;

fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
fastcgi_param   SCRIPT_NAME             $fastcgi_script_name;
fastcgi_param   PATH_INFO               $fastcgi_path_info;
fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info;
fastcgi_param   REQUEST_URI             $request_uri;
fastcgi_param   DOCUMENT_URI            $document_uri;
fastcgi_param   DOCUMENT_ROOT           $document_root;
fastcgi_param   SERVER_PROTOCOL         $server_protocol;

fastcgi_param   GATEWAY_INTERFACE       CGI/1.1;
fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version;

fastcgi_param   REMOTE_ADDR             $remote_addr;
fastcgi_param   REMOTE_PORT             $remote_port;
fastcgi_param   SERVER_ADDR             $server_addr;
fastcgi_param   SERVER_PORT             $server_port;
fastcgi_param   SERVER_NAME             $http_host; #server_name;

fastcgi_param   HTTPS                   $https;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param   REDIRECT_STATUS         200;

The rest of the server block is;

server {

    listen 443 ssl http2;

    server_name <server1>;

    root /var/www/redcap;

    index index.php index.html index.htm;

    access_log /var/log/nginx/redcap.access.log;
    error_log /var/log/nginx/redcap.error.log error;

    location ~ \.php$ {
        # Mitigate https://httpoxy.org/ vulnerabilities
        fastcgi_param HTTP_PROXY "";
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass    unix:/var/run/php-fpm-redcap.sock;
        fastcgi_index index.php;
        #fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        # Ensure can be accessed via SSH tunnel using X-Forwarded-For
            set_real_ip_from <ip 1>/16;
            set_real_ip_from <ip 2>/12;
            real_ip_header X-Forwarded-For;
    ssl_certificate     /etc/ssl/certs/cert1.crt;
    ssl_certificate_key /etc/ssl/private/cert1.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    add_header Strict-Transport-Security "max-age=31536000" always

Thanks for reading this, not sure how to proceed, logs don't contain any detail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.