summaryrefslogtreecommitdiff
path: root/gnu/services/web.scm
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/services/web.scm')
-rw-r--r--gnu/services/web.scm8
1 files changed, 8 insertions, 0 deletions
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 45897d7d6f..818226a4f7 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -1144,6 +1144,14 @@ a webserver.")
(uri "~ \\.php$")
(body (list
"fastcgi_split_path_info ^(.+\\.php)(/.+)$;"
+
+ ;; Include some upstream recommendations from
+ ;; https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi
+ ;; Mitigate https://httpoxy.org/ vulnerabilities
+ "fastcgi_param HTTP_PROXY \"\";"
+ ;; Only pass existing php files to the backend.
+ "if (!-f $document_root$fastcgi_script_name) { return 404; }"
+
(string-append "fastcgi_pass unix:" socket ";")
"fastcgi_index index.php;"
(list "include " nginx-package "/share/nginx/conf/fastcgi.conf;")))))