I was getting 403 & 404 errors on a Magento application I was working on I tracked down the issue to two blocks in the NGINX configuration, if I comment them out the issues are resolved but I would like to understand better what I'm commenting out.
ISSUE 1
I was getting a 403 error on URLs such as
http://www.example.com/media/wysiwyg/.thumbs/wysiwyg/banner.jpg
I guessed this was due to the below code block & sure enough when I commented it out it worked!
# Deny all attempts to access hidden files
# such as .htaccess, .htpasswd, etc...
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
The issue with this now is that my .gitignore file is now accessible. How can I rewrite this block better? What does ~ /\. mean?
ISSUE 2
I was getting a 404 error on URLs such as:
http://www.example.com/js/gene/braintree/braintree-0.1.js
I discovered if I changed the name of this file to braintree-0.1.min.js I stopped getting the 404 error on it, and when I removed the below block from NGINX it loaded fine with it's origional name, braintree-0.1.js so it must of had something to do with the dots at the end of the file name.
##
# Rewrite for versioned CSS+JS via filemtime
##
location ~* ^.+\.(css|js)$ {
rewrite ^(.+)\.(\d+)\.(css|js)$ $1.$3 last;
expires 31536000s;
access_log off;
log_not_found off;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
}
I'm not really sure what this block was doing or what ~* ^.+\.(css|js)$ means, I'm sure I just took it off someones blog who recommended it. Any idea what it is doing?
Below is my full NGINX configuration file, thanks in advance for any help and advice you may have :)
server { # Listen on port 80 as well as post 443 for SSL connections. listen 8080; #listen 443 default ssl;
server_name www.example.com;
# Specify path to your SSL certificates.
#ssl_certificate /etc/nginx/certificates/yourcertificate.crt;
#ssl_certificate_key /etc/nginx/certificates/yourcertificate.key;
# Path to the files in which you wish to
# store your access and error logs.
#access_log /path/to/your/logs/access_log;
#error_log /path/to/your/logs/error_log;
# If the site is accessed via mydomain.com
# automatically redirect to www.magento.localhost.com.
#if ($host = 'example' ) {
#rewrite ^/(.*)$ http://www.example/$1permanent;
#}
root /var/www/example/;
auth_basic "Restricted website - authorised access only";
auth_basic_user_file /etc/nginx/.htpasswd;
location / {
index index.html index.htm index.php;
try_files $uri $uri/ @handler;
}
#include hhvm.conf; # INCLUDE HHVM HERE
# Deny access to specific directories no one
# in particular needs access to anyways.
location /app/ { deny all; }
location /includes/ { deny all; }
location /lib/ { deny all; }
location /media/downloadable/ { deny all; }
location /pkginfo/ { deny all; }
location /report/config.xml { deny all; }
location /var/ { deny all; }
# Allow only those who have a login name and password
# to view the export folder. Refer to /etc/nginx/htpassword.
#location /var/export/ {
# auth_basic "Restricted";
# auth_basic_user_file htpasswd;
# autoindex on;
#}
location ~* /magmi($|/) {
auth_basic "Restricted website - authorised access only";
auth_basic_user_file /etc/nginx/.htpasswd;
location ~ \.php$ {
if (!-e $request_filename) {
rewrite / /index.php last;
}
expires off;
# --PHP5-FPM CONFIG START (keep fastcgi_param HTTPS OFF)--
#fastcgi_pass unix:/var/run/php5-fpm.sock;
##fastcgi_param HTTPS $fastcgi_https;
#fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# --PHP5-FPM CONFIG START--
# --HHVM CONFIG START--
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# include fastcgi_params;
try_files $uri $uri/ @handler;
# --HHVM CONFIG END--
fastcgi_param MAGE_RUN_CODE default;
fastcgi_param MAGE_RUN_TYPE store;
include fastcgi_params;
}
}
# Deny all attempts to access hidden files
# such as .htaccess, .htpasswd, etc...
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# This redirect is added so to use Magentos
# common front handler when handling incoming URLs.
location @handler {
rewrite / /index.php;
}
# Forward paths such as /js/index.php/x.js
# to their relevant handler.
location ~ .php/ {
rewrite ^(.*.php)/ $1 last;
}
##
# Rewrite for versioned CSS+JS via filemtime
##
location ~* ^.+\.(css|js)$ {
rewrite ^(.+)\.(\d+)\.(css|js)$ $1.$3 last;
expires 31536000s;
access_log off;
log_not_found off;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
}
##
# Aggressive caching for static files
# If you alter static files often, please use
# add_header Cache-Control "max-age=31536000, public, must-revalidate, proxy-revalidate";
##
location ~* \.(asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|ogv|otf|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|t?gz|tif|tiff|ttf|wav|webm|wma|woff|wri|xla|xls|xlsx|xlt|xlw|zip)$ {
expires 31536000s;
access_log off;
log_not_found off;
add_header Pragma public;
add_header Cache-Control "max-age=31536000, public";
}
# Handle the exectution of .php files.
location ~ .php$ {
if (!-e $request_filename) {
rewrite / /index.php last;
}
expires off;
# --PHP5-FPM CONFIG START (keep fastcgi_param HTTPS OFF)--
#fastcgi_pass unix:/var/run/php5-fpm.sock;
##fastcgi_param HTTPS $fastcgi_https;
#fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
# --PHP5-FPM CONFIG START--
# --HHVM CONFIG START--
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#include fastcgi_params;
try_files $uri $uri/ @handler;
# --HHVM CONFIG END--
fastcgi_param MAGE_RUN_CODE default;
fastcgi_param MAGE_RUN_TYPE store;
include fastcgi_params;
}
}
