The body in request is returned in response

Question

I am using docker with ngnix, php and mysql. Also i am using api platform version 2.6.4. After i while when the server is doing nothing and then when i do a request to an endpoint it will return normal response but also with the json the was in the body of request. I tried to debug this but this does not come from the code it seems it is form ngnix or I do not know. But this happens after the server is idle for some time no request are send but then when i send a request the response also have the body of request. But also this do not apply for all request sometimes the response is good without request body. For example i send post request to login endpoint with body

{
    "email": "test@test.eu",
    "password": "password"
}

and get response:

{
        "email": "test@test.eu",
        "password": "password"
    }{"token":"eyJ0eXAiOiOtS4wxOtXAdA..."}

which is wrong and sometime i get normal response like:

{"token":"eyJ0eXAiOiOtS4wxOtXAdA..."}

Here is my conf files.

[mysql]
extension = pdo_mysql

[intl]
extension = intl

[apcu]
extension = apcu

[sodium]
extension = sodium

[zip]
extension = zip

[php]
apc.enable_cli = 1
date.timezone = Europe/Bratislava
session.auto_start = Off
short_open_tag = Off
expose_php = Off
realpath_cache_size = 4096K
realpath_cache_ttl = 600

[opcache]
zend_extension = opcache

opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 20000
opcache.memory_consumption = 256
opcache.validate_timestamps = 0
opcache.preload_user=www-data
opcache.preload=/var/www/config/preload.php

---

user nginx;
worker_processes auto;
daemon off;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /var/log/nginx/access.log;

    sendfile off;
    keepalive_timeout 65;

    gzip on;
    gzip_types text/html application/xml application/ld+json application/json ;

    server {
        server_name localhost;
        root /var/www/public;
    
        location / {
            # try to serve file directly, fallback to app.php
            try_files $uri /index.php$is_args$args;
        }
    
        location ~ ^/index\.php(/|$) {
            # optionally set the value of the environment variables used in the application
            # fastcgi_param APP_ENV prod;
    
            # When you are using symlinks to link the document root to the current version of your application, you should
            # pass the real application path instead of the path to the symlink to PHP FPM. Otherwise, PHP's OPcache may
            # not properly detect changes to your PHP files (see https://github.com/zendtech/ZendOptimizerPlus/issues/126).
            fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
            fastcgi_param DOCUMENT_ROOT $realpath_root;
    
            # Bigger buffer size to handle cache invalidation headers expansion
            fastcgi_buffer_size 32k;
            fastcgi_buffers 8 16k;
    
            # Sets the address of a FastCGI server. The address can be specified as a domain name or IP address, and a port
            fastcgi_pass php:9000;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            include fastcgi_params;
    
            internal;
       }
    
        # return 404 for all other php files not matching the front controller
        # this prevents access to other php files you don't want to be accessible.
        location ~ \.php$ {
            return 404;
        }
    }

}

This applies for all PATCH, POST endpoinst. Did somebody experience this kind of behavior. I didi try to disable opcache also apcu but it does not help.

Thx

Answer 1

The problem was in my configuration of php container i did have open port 9000 (-p 9000:9000). So anybody was able do an attack after this request "POST /usr/local/lib/php/PEAR.php 200" the server started do this. After fixig this configuration and reinstalling containers everythink is fine. closing