☰

nginx 在 HTTP 上下载 php 脚本，但不在 HTTPS 上下载

tag-icon • tag-icon nginx php php-fpm ajenti
nginx 在 HTTP 上下载 php 脚本，但不在 HTTPS 上下载

我的服务器上有 nginx 和 php-fpm。我使用 SSL（Let's Encrypt）配置了 nginx，并将 HTTPS 设为默认设置，而不是 HTTP。问题是，当通过 HTTP 访问 Web 时，会下载 php 文件，但在 HTTPS 中脚本可以正常工作。我重新启动了 nginx/php，清理了缓存，尝试了其他浏览器和 chmod，但问题仍然存在。

我使用 ajenti 作为控制面板，因此配置是自动生成的。

client_max_body_size 128m;
large_client_header_buffers 4 64k;
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1;mode=block";
add_header X-Content-Security-Policy "allow 'self';";

ssl_prefer_server_ciphers on;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/trustchain.pem;
resolver 8.8.8.8 8.8.4.4;

server {
    listen *:80 http2;
    listen *:443 ssl http2 default_server;
    ssl_certificate /etc/letsencrypt/live/domain.xyz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.xyz/privkey.pem;
    server_name domain.xyz;

    access_log /var/log/nginx/domainxyz.access.log;
    error_log /var/log/nginx/domainxyz.error.log;

    root /var/www/domain.xyz;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    rewrite /wp-admin$ $scheme://$host$uri/ permanent;

    location = /favicon.ico {
            log_not_found off;
            access_log off;
    }

    location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
    }

    location ~ /\. {
            deny all;
    }

    location ~* /(?:uploads|files)/.*\.php$ {
            deny all;
    }

    location /wp-admin {
            auth_basic "Acceso restringido";
            auth_basic_user_file /var/www/pass.htpasswd;
    }

    location /wp-config.php {
            deny all;
    }

    location /wp-login.php {
            auth_basic "Acceso restringido";
            auth_basic_user_file /var/www/pass.htpasswd;
    }

    location ~ /.well-known {
            allow all;
    }

    location ~ [^/]\.php(/|$) {
            fastcgi_index index.php;
            include fcgi.conf;
            fastcgi_pass unix:/var/run/ajenti-v-php7.0-fcgi-domainxyz-php7.0-fcgi-0.sock;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }
}

nginx 1.11.1
php-fpm 7.0.8
Debian 8

答案1

您的配置很奇怪。实际上，http2 只能通过 https 工作。您应该定义一个转发到 https 的服务器，而不是一个同时为两者提供服务的服务器。您应该在每个文件中定义一个服务器

你应该读我的Nginx 教程，但关键部分如下。

将其添加到您的 nginx.conf。我把大多数人使用的 sites-enabled 改为 enabled-sites，因为这样更容易进行制表符补全。

include /etc/nginx/enabled-sites/*;

主服务器，位于 /etc/nginx/enabled-sites/example.com.conf

server {
  server_name www.example.com;
  listen 443 ssl http2;

  ssl_certificate /var/lib/acme/live/fullchain;
  ssl_certificate_key /var/lib/acme/live/privkey;

  # Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

  # This is a cache for SSL connections
  ssl_session_cache shared:SSL:2m;
  ssl_session_timeout 60m;

  root /var/www/pts;

  // etc
}

然后转发服务器

# Redirect all variations to https://www domain
server {
  listen 80;
  server_name example.com www.example.com;
  return 301 https://www.example.com$request_uri;
}

我还定义了一个单独的默认服务器。不过，你可能需要使用更准确的返回代码

server {
  listen      80 default_server;
  server_name _;
  access_log off; log_not_found off;

  return 418; # "I'm a teapot", effectively "go away" https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error

}

相关内容