Access denied (403) for PHP files with Nginx + PHP-FPM

Question

I have been spending few hours on that issue and despite the high number of posts related to it, I cannot solve it. I have a Fedora 20 box with Nginx + PHP-FPM that worked q

Answer 1

It may be related to selinux. If you use the shared folder of Virtual Box, you cannot change the access permissions in this folder in Linux. Therefore, you can solve it after closing selinux.

Answer 2

For reference of those coming later: In the conf for your site try to add: fastcgi_param PATH_INFO $fastcgi_path_info; Also look at what SELinux is doing. To turn it off: setenforce 0 But then figure what script is the issue and put back to setenforce 1

Answer 3

Please note that the above solution (set cgi.fix_pathinfo to 1) is a terrible idea. See https://nealpoole.com/blog/2011/04/setting-up-php-fastcgi-and-nginx-dont-trust-the-tutorials-check-your-configuration/ for a good overview.

The issue is probably down to your application relying on PATH_INFO. Enable access logging for php to get more information about how your application is called to help you debug this issue.

Once again, just to be sure - the accepted solution is a terrible idea, and will likely get your site hacked.

Answer 4

This could also happen if there is no index.php in your vhost document root.

Carefully double-check the www_root parameter in your nginx configuration. Then double check that the php file you're trying to hit is actually in there.

In my case, I mis-typed the vhost doc root path and so pointed it to an empty directory, yielding a 403.

Answer 5

Here are some possible solutions:

1. In your php-fpm www.conf set security.limit_extensions to .php or .php5 or whatever suits your environment. For some users, completely removing all values or setting it to FALSE was the only way to get it working.

2. In your nginx config file set fastcgi_pass to your socket address (e.g. unix:/var/run/php-fpm/php-fpm.sock;) instead of your server address and port.

3. Check your SCRIPT_FILENAME fastcgi param and set it according to the location of your files.

4. In your nginx config file include fastcgi_split_path_info ^(.+\.php)(/.+)$; in the location block where all the other fastcgi params are defined.

5. In your php.ini set cgi.fix_pathinfo to 1

Answer 6

I ran into the same problem, and after trying all the suggestions above it still didn't work. Then I checked my files. Obviously I am not a server expert.

It turned out I have a folder /sites-available and /sites-enabled. I had updated the default file in the sites-available folder but not in the /sites-enabled folder. After doing that (and a restart of nginx), it all started to work.

Took me some time to solve this, I hope this helps someone else to fix it sooner.