Nginx – How to tell Nginx to not rewrite URL’s in selected location

nginxPHPrewriteurl

I am writing some PHP CMS code with a clean url implementation in Nginx. To improve security of my code I want to rewrite all of the requests in my root directory / using the following type:

rewrite ^(.*)$ /index.php?q=$1 last;

With this kind of rewrite the rest of the php scripts will not be accessible from the user's side (they will be only, if included in php, am I right?). However, I do not want to rewrite the request in one location (for mi that will me /static/), because I will be serving only static content such as images and css from that location. How can I make this rewrite not work in certain locations?

Best Answer

Understanding and using the location directive should solve your problem. When location is followed only by a prefix string (i.e. without modifiers such as '=', or '~*'), the longest prefix string is matched first. For example:

server {
    server_name example.org;
    root /var/www/site;

    location / {
        # Configuration A
    }

    location /static {
        # Configuration B
    }

In this configuration, the URL example.org/static/foo.gif would match Configuration B because the prefix string /static is longer than /. Meanwhile, example.org/index.php?q=bar would match Configuration A because that is the only match.

You could then have Configuration A serve up content with PHP, while Configuration B serves static content.

Also, I would highly recommend reading through the Nginx Pitfalls page, if you haven't already. It addresses some issues that are highly relevant in your situation, such as taxing rewrites, using fastcgi_pass safely, and so forth.

Correct way in new versions of nginx

Turn out my first answer to this question was correct at certain time, but it turned into another pitfall - to stay up to date please check Taxing rewrite pitfalls

I have been corrected by many SE users, so the credit goes to them, but more importantly, here is the correct code:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

server {
       listen         443 ssl;
       server_name    my.domain.com;
       # add Strict-Transport-Security to prevent man in the middle attacks
       add_header Strict-Transport-Security "max-age=31536000" always; 

       [....]
}

Nginx serve static files directly if not matched by rewrite rules

Solution:

location / {
    try_files $uri $uri/ /index.php;
}

# serve static files directly
location ~* \.(?:jpg|jpeg|gif|css|png|js|ico)$ {
    access_log        off;
    expires           30d;
    add_header Pragma public;
    add_header Cache-Control "public";
    try_files $uri @fallback;
}

location @fallback {
    rewrite ^/(js|css)/([a-z0-9.]+)\.(js|css)$ /$1/index.php?hash=$2;
}

location ~ \.php$ {
    # basic settings for php files
}

Best Answer

Related Solutions

Nginx – In Nginx, how can I rewrite all http requests to https while maintaining sub-domain

Correct way in new versions of nginx

Nginx serve static files directly if not matched by rewrite rules

Related Topic