# PH Fast-CGI security pitfall

**URL:** <https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132>\
**Category:** NGINX\
**Created:** [November 22, 2011, 8:34pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132 "2011-11-22T20:34:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [November 22, 2011, 8:34pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132/1 "2011-11-22T20:34:13Z")

</div>

Hello,

I juste read this  
article[https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/](https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/)which  
highlight a common security pitfall to serve PHP files.  
I don’t see any similar advice in your PHP on Fast-CGI  
tutorial[http://wiki.nginx.org/PHPFcgiExample](http://wiki.nginx.org/PHPFcgiExample)nor your  
pitfalls page [http://wiki.nginx.org/Pitfalls](http://wiki.nginx.org/Pitfalls).

On the last page, you tell about the problem in the _Pass Non-PHP  
Requests  
to PHP_ section, you seem to point in the right direction in the _Proxy  
everything_ section, but not for the right reasons.  
You tell people to use an ‘if’ to check for file existence, but the use  
of  
‘try’ is much better, a you know it since you redirect to the IfIsEvil  
page.

## The article I gave you reference to offers 5 different wys to secure the server. The ‘try\_files $uri =404;’ seems to be a nice way of preventing non-PHP script from being executed, isn’t it? Thanks,

_B. R._

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [November 22, 2011, 8:58pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132/2 "2011-11-22T20:58:58Z")

</div>

On Tue, Nov 22, 2011 at 2:32 PM, B.R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> You tell people to use an ‘if’ to check for file existence, but the use of  
> ‘try’ is much better, a you know it since you redirect to the IfIsEvil page.
> 
> The article I gave you reference to offers 5 different wys to secure the  
> server. The ‘try\_files $uri =404;’ seems to be a nice way of preventing  
> non-PHP script from being executed, isn’t it?

I generally use the following template for serving PHP via FastCGI:

location ~ .php$ {  
if (!-f $request\_filename) { return 404; }

```
fastcgi_pass 127.0.0.1:8000;
fastcgi_param SCRIPT_FILENAME $request_filename;
...

```

}

The ‘if’ statement causes 404 to be returned unless the requested file  
actually exists. Making sure that people can’t upload files ending in  
‘.php’ is a separate mater, but I believe that this configuration  
takes care of the security issue described in your first link.

For the given example, nginx detects that  
[http://www.bambookites.com/uploads/random.gif/somefilename.php](http://www.bambookites.com/uploads/random.gif/somefilename.php) doesn’t  
refer to an actual php file, so nothing is passed to the interpreter.

- Max

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [November 22, 2011, 9:06pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132/3 "2011-11-22T21:06:23Z")

</div>

Your use of the if switch is enlisted in the pitfalls page of  
nginx[http://wiki.nginx.org/Pitfalls](http://wiki.nginx.org/Pitfalls)(see  
_Check IF File Exists_ section) :o)  
It is said you should use the try one!

## My message was: is using the try switch with the ‘=404’ the right way? If yes can someone add that to the nginx wiki?

_B. R._

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [November 22, 2011, 9:07pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132/4 "2011-11-22T21:07:38Z")

</div>

According previous article

> **[Pitfalls and Common Mistakes | NGINX](https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/)**
>
> This page outlines some of the NGINX configuration issues that we see frequently and then explains how to resolve them.

in your template better to write:

location ~ .php$ {  
try\_files $uri =404;

```
 fastcgi_pass 127.0.0.1:8000;
 fastcgi_param SCRIPT_FILENAME $request_filename;
 ...

```

}

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [November 22, 2011, 9:29pm UTC](https://www.ruby-forum.com/t/ph-fast-cgi-security-pitfall/214132/5 "2011-11-22T21:29:19Z")

</div>

It doesn’t matter whether you use if or try\_files. If people would  
actually read the if is evil page then it specifically states that “It  
is important to note that the behaviour of if is not inconsistent, given  
two identical requests it will not randomly fail on one and work on the  
other, with proper testing and understanding ifs can be used.”

If you prefer if then use an if, if you prefer try\_files then use a  
try\_files, there’s really no reason to agonize over this issue.

Posted at Nginx Forum:

> **[Re: PH Fast-CGI security pitfall](https://forum.nginx.org/read.php?2,218755,218761#msg-218761)**
>
> Hello, I juste read this articlehttps://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/which highlight a common security pitfall to serve PHP files. I don't see any similar advice in your...