NginX Friendly PHP Framework

Question

I am looking for a PHP framework that, if I'm lucky, just works in nginx under FastCGI, otherwise, one that doesn't take too much tweaking.

Ehm, what problems did you encounter with one of the 200 existing PHP frameworks? — mario
– mario, Commented Oct 22, 2010 at 16:27
Frameworks dont care about the web server. You just have to set it up correctly. — Galen
– Galen, Commented Oct 22, 2010 at 16:31
@Galen: The contents of $_SERVER vary by web server, so tweaking is indeed required. — cmc
– cmc, Commented Jul 19, 2011 at 16:14

cmc · Accepted Answer · 2012-06-25 13:33:03Z

23

Symfony 1.4 with nginx is fantastic. I have already done the tweaking, here is a generalization of my production config that I can vouch is fit for production use.

server {
  listen 80;

  server_name mysite.com;

  root /var/www/mysite.com/web;
  access_log /var/log/nginx/mysite.com.access.log;
  error_log /var/log/nginx/mysite.com.error.log;

  location ~ ^/(index|frontend|frontend_dev|backend|backend_dev)\.php$ {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
    fastcgi_param HTTPS off;
    fastcgi_pass   127.0.0.1:9000;
  }

  location / {
    index index.php;
    try_files $uri /index.php?$args;
  }
}

server {
  listen 443;

  ssl on;
  ssl_certificate      /etc/ssl/certs/mysite.com.crt;
  ssl_certificate_key  /etc/ssl/private/mysite.com.key;

  server_name mysite.com;

  root /var/www/mysite.com/web;
  access_log /var/log/nginx/mysite.com.access.log;
  error_log /var/log/nginx/mysite.com.error.log;
  location ~ ^/(index|frontend|frontend_dev|backend|backend_dev)\.php$ {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
    fastcgi_param HTTPS on;
    fastcgi_pass   127.0.0.1:9000;
  }

  location / {
    index index.php;
    try_files $uri /index.php?$args;
  }
}

PHP 5.4 Note

php5-fpm 5.4 that comes with dotdeb now uses sockets instead of the loopback by default. If you are using PHP 5.4 and you are getting a bad gateway error with the above config, try replacing all instances of 127.0.0.1:9000 with unix:/var/run/php5-fpm.sock.

php-fpm 5.4 also newly limits the file extensions that can be parsed as PHP to those specified in security.limit_extensions. This might be of interested if you have modified the location regex to include other file extensions than .php. The security note below still applies.

Security Note

This config only parses the files index.php, frontend.php, frontend_dev.php, backend.php and backend_dev.php with PHP.

With php and nginx in general, not just with symfony, using

location \.php$ {
  ...
}

causes a security vulnerability related to URLs that use pathinfo, like these: /index.php/foo/bar.

The common workaround is to set fix_pathinfo=0 in php.ini. This breaks pathinfo URLs, and symfony relies on them. The solution used here is to explicitly specify the files that get parsed as php.

For more information, see the nginx+php-cgi security alert

Platforms

This works and is secure on Debian Squeeze systems that use dotdeb for nginx and php-fpm packages, as well as Ubuntu 10.04 Lucid Lynx systems that use ppa/brianmercer for php-fpm. It might or might not work and be secure on other systems.

Usage note

To add another PHP file additionalfile.php to get parsed, use this syntax in both location blocks:

location ~ ^(index|frontend|frontend_dev|backend|backend_dev|additionalfile).php$ { ... }

Edit: Symfony 2.0 is out! Here is the config, adapted from the 1.4 config above:

server {
  listen 80;

  server_name symfony2;
  root /var/www/symfony2/web;

  error_log /var/log/nginx/symfony2.error.log;
  access_log /var/log/nginx/symfony2.access.log;

  location / {
    index app.php;
    if (-f $request_filename) {
      break;
    }
    rewrite ^(.*)$ /app.php last;
  }

  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  #
  location ~ (app|app_dev).php {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
    fastcgi_param HTTPS off;
    fastcgi_pass   127.0.0.1:9000;
  }
}

server {
  listen 443;

  server_name symfony2;
  root /var/www/symfony2/web;

  ssl on;
  ssl_certificate      /etc/ssl/certs/symfony2.crt;
  ssl_certificate_key  /etc/ssl/private/symfony2.key;

  error_log /var/log/nginx/symfony2.error.log;
  access_log /var/log/nginx/symfony2.access.log;

  location / {
    index app.php;
    if (-f $request_filename) {
      break;
    }
    rewrite ^(.*)$ /app.php last;
  }

  # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
  #
  location ~ (app|app_dev).php {
    include fastcgi_params;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
    fastcgi_param HTTPS off;
    fastcgi_pass   127.0.0.1:9000;
  }
}

edited Jun 25, 2012 at 13:33

answered Jul 19, 2011 at 16:12

cmc

4,4232 gold badges39 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Sebastián Grignoli Over a year ago

I had to remove the $ from your first location block in the 1.4 version for this kind of paths to work for me: /backend_dev.php/module/action. Is that bad in terms of security?

cmc Over a year ago

@SebastiánGrignoli Yes, that will cause a potential security vulnerability as well as a safety hazard. Someone could upload a file called index.php.jpg containing malicious php code and nginx will execute it. Or, you could upload a file index.php.txt, in which you intended to show your friends your example code for your recursive version of php's "unlink" function.

Sebastián Grignoli Over a year ago

But as long as the third party malicious index.php.jpg does not reside in the root of the site, it won't match the expression and thus not execute. Right?

cmc Over a year ago

You are right. But it is a bit like arguing a small landmine in your house is better than a big one.

Sebastián Grignoli Over a year ago

This whole Nginx approach to security seems like that to me.

rojoca · Accepted Answer · 2010-10-22 16:38:25Z

2

As some commenters have noted you just need to set up nginx correctly. Here's a post that sets up nginx for codeigniter.

answered Oct 22, 2010 at 16:38

rojoca

11.2k4 gold badges47 silver badges47 bronze badges

3 Comments

Rixius Over a year ago

I have been looking for either frameworks that require little tono setup, or posts illustrating how to set some up, thank you for this, i hadn't Stumbles across it; this helps a lot.

rojoca Over a year ago

If you want to get the most out of nginx you really need to learn all the ins and outs of its configuration. If you want easy setup you're better off using apache

Rixius Over a year ago

The more I have read the more I have realized that you are absolutely correct Rojoca, I was merly being lazy, and your link about codeignitor has helped wonders.

MaximKostrikin · Accepted Answer · 2015-03-21 11:58:04Z

0

This repo helped me with symfony 1.4 on nginx+php-fpm [https://raw.githubusercontent.com/korjavin/docker-nginx-symfony/my/default][1]

answered Mar 21, 2015 at 11:58

MaximKostrikin

1,3401 gold badge8 silver badges5 bronze badges

Collectives™ on Stack Overflow

NginX Friendly PHP Framework

3 Answers 3

PHP 5.4 Note

Security Note

Platforms

Usage note

5 Comments

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

PHP 5.4 Note

Security Note

Platforms

Usage note

5 Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related