Nginx配置拒绝访问私有Laravel文件夹

Question

Every answer or tutorial about nginx configuration on Laravel has something like that:

location ~ \.php {
    # fastcgi stuff ...
}

If the Laravel framework has a unique entry point (the public index.php ), wouldn't it be this definition more accurate?

location ~ index\.php {
    # fastcgi stuff ...
}

In a context where you have your app deployed on a subfolder, the first configuration it's allowing the access on every php private file, even if I have already defined a deny all rule over the private folder.

I'm wrong with anything?

There is another way to define a fully deny access over a folder?

Answer 1

If you want deny access to files in your private folder (eg /private ) add this to your config for virtual host:

Case sensitive

location ~ ^/private/(.*)\.php$ {
    deny all;
}

Case insensitive:

location ~* ^/private/(.*)\.php$ {
    deny all;
}

This returns 403 all requests to /private/something.php , /private/something/something.php and so on. But requests to /private/something will work.