为什么REQUEST_METHOD被错误地报告为“ GET”？

Question

I'm using nginx + php5-fpm for my local development site. While building a form I ran into an extremely strange issue.

It seems that $_SERVER['REQUEST_METHOD'] is sometimes misreported as "GET" when I am POSTing. It gets stranger though: this only seems to happen if the URL contains the magic word "block".

For example, if I run the following request:

POST /block HTTP/1.1
Host: dev.bla.com
Content-Type: application/x-www-form-urlencoded
[...]

The server incorrectly reports this as a GET request, as a var_dump on $_SERVER will show you (the var_dump is the first and last piece of code executed, there is nothing influencing it):

array (size=37)
  'USER' => string 'www-data' (length=8)
  'HOME' => string '/var/www' (length=8)
  'FCGI_ROLE' => string 'RESPONDER' (length=9)
  'QUERY_STRING' => string '' (length=0)
  'REQUEST_METHOD' => string 'GET' (length=3)
  'CONTENT_TYPE' => string 'application/x-www-form-urlencoded' (length=33)
  [....]

Even the $_POST superglobal is empty. Any URL that does not contain the magic word is reported correctly. I have verified the above with Postman and Google Chrome.

For reference, here is my nginx configuration file:

server {
    ## Basic configuration
    listen 80;
    root /var/projects/bla;
    index index.php;
    server_name dev.bla.com;

    ## Restrict all directory listings
    autoindex off;

    ## Set the error page to index.php. As index.php applies routing
    ## (based on REQUEST_URI), our own error page will show up.
    error_page 404 = /index.php;

    ## Rewrite everything to index.php, but maintain query string
    location / {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    ## Block folders (PHP source code etc)
    location ~ /(code|controllers|models|vendor|views) {
        deny all;
        return 404;
    }

    ## Block file extensions (configuration, composer, READMEs, etc)
    location ~ (\.xml|sql|phar|json|lock|conf|cfg|gitignore|md) {
        deny all;
        return 404;
    }

    ## Proxy requests to php-fpm listening on a Unix socket
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }
}

My PHP Version is 5.5.14.

How can I fix this?

Answer 1

This rule:

location ~ (\.xml|sql|phar|json|lock|conf|cfg|gitignore|md) {
    deny all;
    return 404;
}

block is matched by lock . Then it goes to index.php you set for 404 error.

Make it:

location ~ \.(xml|sql|phar|json|lock|conf|cfg|gitignore|md)$ {
    deny all;
    return 404;
}

The other rule is also potential for trouble.