Many of the guides for setting up Wordpress (or similar applications) on nginx with php-fpm use a configuration that in part looks something like this:
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
if (!-f $document_root$fastcgi_script_name) {
#some guides suggest try_files $uri =404; instead
return 404;
}
fastcgi_pass php;
fastcgi_index index.php;
include fastcgi_params;
}
#Route anything not otherwise matched
location / {
try_files $uri $uri/ /index.php$is_args$args;
}
With this configuration if the requested URI /someuri
isn't an actual location it'll get routed to index.php
and from there to the backend.
The 404
part is there to prevent unauthorized code execution, so if the requested URI is /somefile.php
which doesn't exist then a simple nginx 404
is generated.
What would be a better way to configure this (& remain 'secure') so that a request for a nonexistant php file also get passed to the backend via index.php
?
0 Answers