How to solve nginx php403 error

nginx php403 error solution: 1. Modify file permissions or enable selinux; 2. Modify php-fpm.conf and add the required file extension; 3. Modify the content of php.ini to "cgi.fix_pathinfo = 0"; 4. Restart php-fpm.

The operating environment of this tutorial: linux5.9.8 system, PHP version 8.1, Dell G3 computer.

How to solve nginx php403 error?

nginx php 403 Cause Analysis

Problem:

When accessing the configured website, an error message appears: Access Denied (403)

Common solutions:

1. File permission problem

It may be a file permission problem, there is no read permissions.

Or selinux is not closed.

2. security.limit_extensions

Check nginx error log error.log and find the following error:

2016/07/07 10:20:13 [error] 17710#0: *2145 FastCGI sent in stderr: "Access to the script '/home/www/game/10313156.html' has been denied (see security.limi
t_extensions)" while reading response header from......

Starting from 5.3.9, PHP has officially added a configuration "security.limit_extensions". By default, only files with the extension ".php" are allowed to be executed, causing the problem that other types of files are not supported.

Official description:

; Limits the extensions of the main script FPM will allow to parse. This can
; prevent configuration mistakes on the web server side. You should only limit
; FPM to .php extensions to prevent malicious users to use other extensions to
; exectute php code.
; Note: set an empty value to allow all extensions.
; Default Value: .php
;security.limit_extensions = .php .php3 .php4 .php5

Modify php-fpm.conf: (Add the required file extension)

security.limit_extensions = .php .html .js .css .jpg .jpeg .gif .png .htm

3. cgi.fix_pathinfo

When accessed through this url, an Acess denied error is displayed.

nginx error log:

2016/07/08 09:47:12 [error] 24297#0: *3348 FastCGI sent in stderr: "Access to the script '/home/www/home.php/game/qr' has been denied (see security.limit_extensions)" while reading response header......

Modify php.ini: (cgi.fix_pathinfo defaults to 1)

cgi.fix_pathinfo = 1

Official description:

; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PATH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://php.net/cgi.fix-pathinfo

In fact, cgi.fix_pathinfo = 1 will cause file type error parsing vulnerability. It is recommended to set cgi.fix_pathinfo = 0.

(About the understanding of the vulnerability:

When cgi.fix_pathinfo=1, access path:/foo.jpg/file.php, if the file.php file does not exist, the php parser It will try to guess which file you want to execute and look back along the path. If foo.jpg exists and contains PHP code, the PHP parser will execute foo.jpg.

When cgi.fix_pathinfo=0 At this time, the PHP interpreter only tries the given path and stops processing if the file is not found.

)

But setting cgi.fix_pathinfo = 0 may cause many MVC frameworks (such as ThinkPHP ) cannot function properly.

4.

Set on php.ini: open_basedir=/home:/tmp/:/proc/

Restart php-fpm

When accessing a web page and pressing ctrl F5 to refresh frequently, an Access Denied error will be reported. Access Denied only appears occasionally, not 403 all the time.

nginx error log record:

2016/07/09 08:32:40 [error] 26954#0: *2127721 FastCGI sent in stderr: "PHP message: PHP Warning:  Unknown: open_basedir restriction in effect. File(/home/www/touch/web/index.php) is not within the allowed path(s): (/home/wwwroot:/tmp/:/proc/) in Unknown on line 0
PHP message: PHP Warning:  Unknown: failed to open stream: Operation not permitted in Unknown on line 0
Unable to open primary script: /home/www/touch/web/index.php (Permission denied)" while reading response header from upstream, client: 117.136.1.22, server: test.hjq.com, request: "GET /index.php?c=Zs&a=getcontent HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "test.hjq.com"

2、In your nginx config file set fastcgi_pass to your socket address (e.g. unix:/var/run/php-fpm/php-fpm.sock;) instead of your server address and port.
3、Check your SCRIPT_FILENAME fastcgi param and set it according to the location of your files.
4、In your nginx config file include fastcgi_split_path_info ^(.+\.php)(/.+)$; in the location block where all the other fastcgi params are defined.

Recommended learning: "PHP Video Tutorial"

The above is the detailed content of How to solve nginx php403 error. For more information, please follow other related articles on the PHP Chinese website!