NGINX Configuration

[peterrehm]

If I understand the configuration correctly according to this document http://symfony.com/doc/current/cookbook/configuration/web_server_configuration.html#nginx

The server will not pass e.g. app_dev.php to php5-fpm but it will download the source instead. If that is confirmed shouldn't the recommended configuration for the prod environment be that no other php file can be executed and will be e.g. forwarded to app.php?

[xabbuh]

Well, some lines above we tell you that you should neither deploy app_dev.php nor config.php to your prod environment. Do you have an idea how we can put more emphasize on this?

[peterrehm]

I see the issue that most people checkout their repository and forget to remove those files. We could add some config redirecting app_*.php and config.php.

[xabbuh]

Can we somehow simply trigger a 404 status code? This way we would also leak less information.

[peterrehm]

Ill look into that, I would expect it should not be a big deal.

[peterrehm]

Just provided an easy solution.

[richardjennings]

I have also found the example Nginx configuration to be a liability for the reasons mentioned here. Any .php file that exists in web/ in production other than app.php will be served as a static file. I would suggest that this caveat is at least mentioned in the documentation.