Nginx – Pass URL component/path to PHP with Nginx

mod-rewritenginxrewrite

I recently switch from Apache to Nginx. I'm brand new to Nginx, so please be kind. One of my apps uses the first URL component as a query string unless the path/file exists – in which case Apache serves the file. Previously, I would pass PHP the first string in the URL path such as example.com/foo (where foo is passed). My old .htaccess looks like this:

<IfModule mod_rewrite.c>

   RewriteEngine On

   RewriteBase /

   # if file or directory exists, serve it   
   RewriteCond %{REQUEST_FILENAME} -f [OR]
   RewriteCond %{REQUEST_FILENAME} -d
   RewriteRule .* - [S=3]
   # if not, pass the url component to PHP as the "section" query string
   RewriteRule ^([^/]+)/?$ ?section=$1 [L]

</IfModule>

I've tried many things in Nginx but because I'm so new, I'm stuck. This seems to get me the closest to what I want:

server {

  root /var/www/mysite.com;

  index index.php;
  server_name www.mysite.com mysite.com;

  location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php7.0-fpm.sock;
  }

  location / {
    rewrite ^/(.*)$ /index.php?section=$1 break;
    try_files $uri $uri/ /index.php$args;
  }

}

Still, the query string doesn't seem to be passed to my index.php script.

I've reviewed these other questions:

https://stackoverflow.com/questions/9641603/remove-parameters-within-nginx-rewrite
(Not exactly what I'm after, speaks to removing additional $args)
https://stackoverflow.com/a/40334028/1171790 (I tried this solution by
replacing 'location' with an empty string but it doesn't seem to pass
the param to PHP)
https://serverfault.com/a/488480/325456 (I'm
unclear what my regex should be after rewrite. This answer uses just
'^'. This seems too broad if I want to still serve my static
files/directories)
https://serverfault.com/a/542550/325456 (This
seemed closest to what I am looking for, but copy/pasting the code
and replacing the filename/values with my own still didn't work for
me)

If someone with a better knowledge of Nginx than I could help me out, I would be eternally grateful.

Best Answer

I ended up using a named location. This functions, but I still feel like there's a better solution out there.

server {

  root /var/www/mysite.com;

  index index.php;
  server_name mysite.com;

  location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php7.0-fpm.sock;
  }

  location / {
    try_files $uri $uri/ @fallback;
  }

  location @fallback {
    rewrite ^/(.*)$ /index.php?section=$1 last;
  }

}

Related Solutions

Nginx, PATH_INFO, and url-rewriting: i must be missing something

Looks like you're following a poor tutorial which is severely outdated (if (!-f is generally not recommended, with try_files offered as a better replacement). You have numerous problems:

First you have directives in location / context which should be in server context, so you can avoid path duplication in the SCRIPT_FILENAME variable.

Secondly, you use the break flag in your rewrite; this means it should not re-evaluate the location matching. This effectively makes the request never leave the location / block and is instead treated as a static file request.

Thirdly, have a look at your location ~ \.php$ {: Nginx matches locations against the URI and you're specifically telling Nginx to only handle URIs which end in .php, but if you rewrite to index.php/test/ then it won't trigger.

Lastly, you're using PATH_INFO while you should be using REQUEST_URI. The difference is that to make PATH_INFO work you have to tell Nginx to pass any request with .php in it to PHP, and PHP has to then find the right file.

This means that you allow requests like example.org/uploads/image.jpg/index.php to be sent to PHP and you also allow PHP to execute the file /uploads/image.jpg. If a malicious user uploaded that file with PHP in it they now have arbitrary code execution on your server. This is a very real exploit that I have personally seen people be vulnerable to.

Please stop using randomly Googled tutorials because 90% of them are utter garbage, instead go read the wiki. It might be a bother having to actually learn about the web server you're using, but the alternative is to have your server compromised.

Nginx rewrite rule to convert URL segments to query string parameters

Disclaimer: None of the following are tested. Please use it with caution. If anything goes wrong, please turn on debugging as mentioned at http://nginx.org/en/docs/debugging_log.html .

See if it's a real file or directory, if so, serve it,
then send all requests for / to Director.php

This may be achieved with...

server {
  index Directory.php;
  location / {
    try_files $uri $uri/ /Directory.php;
  }
}

The index directive is enough for directory index. To send all requests to Director.php, then location block is needed.

If the URL has one segment, pass it as rt

You may try the following...

rewrite "^/([a-zA-Z0-9\-\_]+)/$" "/Director.php?rt=$1" last;

Please remember the quotes around the rewrites. It is preferable to use quotes, and is needed on certain conditions (that is mentioned in the link provided earlier by @jerm).

If the URL has two segments, pass it as rt and action

You may try the following...

rewrite "^/([a-zA-Z0-9\-\_]+)/([a-zA-Z0-9\-\_]+)/$" "/Director.php?rt=$1&action=$2" last;

Please note that I haven't done anything for QSA in the above examples. You may try $args variable in Nginx to pass the existing query string to the new query string. Ref: http://nginx.org/en/docs/http/ngx_http_core_module.html#variables

I hope that helps to arrive at the full working solution!

Best Answer

Related Solutions

Nginx, PATH_INFO, and url-rewriting: i must be missing something

Nginx rewrite rule to convert URL segments to query string parameters

Related Topic