# Will request\_uri get passed from cookieless server to 403 page on main server?

**URL:** <https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523>\
**Category:** NGINX\
**Created:** [November 17, 2013, 9:16pm UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523 "2013-11-17T21:16:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\
**Post date:** [November 17, 2013, 9:16pm UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/1 "2013-11-17T21:16:59Z")

</div>

Migrating to a new server and thought I’d take the time to set up a  
cookieless subdomain on it for static files.

In my current setup, 403 errors are sent to a php file which grabs the  
$\_SERVER[“REQUEST\_URI”], locates the page of the photo on the site, and  
redirects the person to that page so they see it in our context.

So now I’m going to set up [static.example.com](http://static.example.com).

If I set the 403 error page to go to  
error\_page 403 [http://www.example.com/dhe403.shtml](http://www.example.com/dhe403.shtml);

in order to run the PHP on the 403 error, does the REQUEST\_URI get  
passed  
between servers or do I have to do some rewrite magic that I currently  
don’t do?

Thanks.

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 18, 2013, 1:21am UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/2 "2013-11-18T01:21:45Z")

</div>

On 17/11/2013 3:16 PM, Ian M. Evans wrote:

> error\_page 403 [http://www.example.com/dhe403.shtml](http://www.example.com/dhe403.shtml);
> 
> in order to run the PHP on the 403 error, does the REQUEST\_URI get passed  
> between servers or do I have to do some rewrite magic that I currently  
> don’t do?
> 
> Thanks.

Just trying to think this through on my own…is it possible to pass the  
request\_uri as a variable to the error page on the new server?

e.g.

error\_page 403 [http://www.example.com/dhe403.shtml?req=$request\_uri](http://www.example.com/dhe403.shtml?req=$request_uri);

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 19, 2013, 12:27am UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/3 "2013-11-19T00:27:46Z")

</div>

On Sun, Nov 17, 2013 at 07:21:02PM -0500, Ian E. wrote:

> On 17/11/2013 3:16 PM, Ian M. Evans wrote:

Hi there,

> > In my current setup, 403 errors are sent to a php file which grabs the  
> > $\_SERVER[“REQUEST\_URI”], locates the page of the photo on the site, and  
> > redirects the person to that page so they see it in our context.

So when a 403 would be generated, you intercept it, do some processing,  
and return an appropriate 302 instead.

> > So now I’m going to set up [static.example.com](http://static.example.com).
> > 
> > If I set the 403 error page to go to  
> > error\_page 403 [http://www.example.com/dhe403.shtml](http://www.example.com/dhe403.shtml);
> > 
> > in order to run the PHP on the 403 error, does the REQUEST\_URI get passed  
> > between servers or do I have to do some rewrite magic that I currently  
> > don’t do?

No, it doesn’t.

That directive says “instead of sending a 403, send a 302 for this other  
url”. What the browser does with that, is up to the browser.

> Just trying to think this through on my own…is it possible to pass the  
> request\_uri as a variable to the error page on the new server?

> error\_page 403 [http://www.example.com/dhe403.shtml?req=$request\_uri](http://www.example.com/dhe403.shtml?req=$request_uri);

You can try. You may have to take care about url escaping, though.

(You can possibly avoid that if you use something like  
…/dhe403.shtml/$request\_uri and handle it appropriately on the far  
side.)

It would seem easier to either proxy\_pass or fastcgi\_pass to the old  
server, in an error\_page 403 location on the new server, if you’re happy  
to have that level of not-just-static involved (and not happy to run  
the full php suite on the new server).

That way, the browser would get one redirect to the intended destination  
instead of one to an intermediate location first.

## f

Francis D. removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 19, 2013, 10:14am UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/4 "2013-11-19T10:14:07Z")

</div>

On 18/11/2013 6:26 PM, Francis D. wrote:

Thanks for your response.

> (You can possibly avoid that if you use something like  
> …/dhe403.shtml/$request\_uri and handle it appropriately on the far  
> side.)

Ok.

> It would seem easier to either proxy\_pass or fastcgi\_pass to the old  
> server, in an error\_page 403 location on the new server, if you’re happy  
> to have that level of not-just-static involved (and not happy to run  
> the full php suite on the new server).
> 
> That way, the browser would get one redirect to the intended destination  
> instead of one to an intermediate location first.

Just to clarify, the two “servers” are on same physical box with the  
same document root, just migrating to a better host. So php is  
installed. I’m just creating two server blocks so that the images will  
be served on a cookieless sub-domain for web performance reasons, i.e.:

server {  
server\_name [www.example.com](http://www.example.com);  
…  
}

server {  
server\_name [static.example.com](http://static.example.com);  
…  
}

On the www block, I currently have this 403 block:

error\_page 403 = /dhe403.shtml;  
location = /dhe403.shtml {  
fastcgi\_pass unix:/var/run/php-fpm.sock;  
fastcgi\_cache off;  
}

So I could add that to my static block as well?

Also, I’d have this “rewrite anything not static” location in the static  
server:

if ($request\_uri !~\*  
“.(gif|js|jpg|jpeg|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|mov)$”)  
{  
rewrite ^(.\*) [http://www.example.com$1](http://www.example.com$1) permanent;  
break;  
}

If I put the 403 location before it, will it still redirect any  
non-static files EXCEPT for the dhe403.shtml?

Thanks!

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 19, 2013, 10:31am UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/5 "2013-11-19T10:31:39Z")

</div>

On Tue, Nov 19, 2013 at 04:13:30AM -0500, Ian E. wrote:

> On 18/11/2013 6:26 PM, Francis D. wrote:

Hi there,

> Just to clarify, the two “servers” are on same physical box with the  
> same document root, just migrating to a better host. So php is  
> installed.

> On the www block, I currently have this 403 block:
> 
> error\_page 403 = /dhe403.shtml;  
> location = /dhe403.shtml {  
> fastcgi\_pass unix:/var/run/php-fpm.sock;  
> fastcgi\_cache off;  
> }
> 
> So I could add that to my static block as well?

Yes.

_If_ that php is set to always return cookies, then you might want to  
run a separate php-fpm that does not return cookies for the static  
site. But that’s a side issue.

> Also, I’d have this “rewrite anything not static” location in the static  
> server:
> 
> if ($request\_uri !~\*

“.(gif|js|jpg|jpeg|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|mov)$”)

> {  
> rewrite ^(.\*) [http://www.example.com$1](http://www.example.com$1) permanent;  
> break;  
> }

That’s not a location. That’s an if() block.

> If I put the 403 location before it, will it still redirect any  
> non-static files EXCEPT for the dhe403.shtml?

I believe that if() at server level gets tested before all locations –  
but it shouldn’t be too hard to check.

Compare that output of “curl -i url” with what you want to see.

If it doesn’t work first time, perhaps putting the if() block inside a  
“location /” and adjusting accordingly would do what you want.

## f

Francis D. removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 23, 2013, 6:56pm UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/6 "2013-11-23T18:56:05Z")

</div>

On 19/11/2013 4:31 AM, Francis D. wrote:

> _If_ that php is set to always return cookies, then you might want to  
> run a separate php-fpm that does not return cookies for the static  
> site. But that’s a side issue.

Still experimenting with this…

What setting stops the php-fpm from not returning cookies?

Is it ‘fastcgi\_ignore\_headers’?

Thanks.

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 23, 2013, 10:04pm UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/7 "2013-11-23T22:04:12Z")

</div>

On Sat, Nov 23, 2013 at 12:55:09PM -0500, Ian E. wrote:

> On 19/11/2013 4:31 AM, Francis D. wrote:

Hi there,

> > _If_ that php is set to always return cookies, then you might want to  
> > run a separate php-fpm that does not return cookies for the static  
> > site. But that’s a side issue.
> 
> Still experimenting with this…
> 
> What setting stops the php-fpm from not returning cookies?

By “return” here, I meant “generate a new one if the request did not  
include one”.

It should be a php configuration, probably involving “session”, possibly  
“session.use\_cookies”.

> Is it ‘fastcgi\_ignore\_headers’?

No, but you could probably “fastcgi\_hide\_header Set-Cookie;”, if your  
fastcgi server insists on sending that header.

I don’t know if it is sufficient to try in nginx – Set-Cookie probably  
comes with some “please do not cache” headers that you would want to  
remove as well, if they aren’t otherwise needed.

## f

Francis D. removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![Ian\_MSEvans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/7bcc69/32.png) [@Ian\_MSEvans](https://www.ruby-forum.com/u/Ian_MSEvans)\
**Post date:** [November 19, 2013, 10:47am UTC](https://www.ruby-forum.com/t/will-request-uri-get-passed-from-cookieless-server-to-403-page-on-main-server/237523/8 "2013-11-19T10:47:26Z")

</div>

On 19/11/2013 4:31 AM, Francis D. wrote:

> _If_ that php is set to always return cookies, then you might want to  
> run a separate php-fpm that does not return cookies for the static  
> site. But that’s a side issue.

Will look into that. Thanks, hadn’t thought of it. Did a cursory glance  
at Google and can’t see how just yet how to disable them.

> That’s not a location. That’s an if() block.

I meant that…but it’s 4am here and I haven’t slept yet. 🙂