Nginx Unit: `404` for hidden folders breaks commonly used routes such as `.well-known/*`

[florian-nolte]

Steps To Reproduce

The Nginx Unit variant now responds with 404 for "hidden" files and folders, see PR. However, this also affects commonly used URLs starting with .well-known, see https://en.wikipedia.org/wiki/Well-known_URI.

Example: create a file .well-known/security.txt in the web root.

Outcome

What did you expect?

A request to /.well-known/security.txt returns status code 200 and the content of the file.

What happened instead?

The returned status code was 404

Affected Docker Images

All unit variants since 3.4.0

Anything else?

No response

[jaydrogers]

Thanks for opening this on here!

I am wondering if @jpangborn has any thoughts on the above issue since he was the author of #458.

I am all ears when it comes to evaluating a proposed solution.

I wonder if there are only specific folders we should ignore (like .git, .ssh, etc) instead of ignoring all?

[jpangborn]

Should be an easy fix. Are there other files or folders starting with . that should be available? I'm open to whatever decision. I can set rules for specific files and folders. Or I can specifically let /.well-known/* through.

In my own small project, I have 5 dot files in the web root. A couple are ignored by either git or docker. Some are not. (This project has .htaccess file for Apache configuration.) Also have several dot folders. They seem to proliferate rapidly. Would rather side on the more secure side of not accidentally granting access where it shouldn't be.

[jpangborn]

Added a quick fix PR to restore access to /.well-known/ URIs while we discuss the right solution.

[jaydrogers]

Thanks for the quick suggestion!

@florian-nolte What do you think of the changes proposed in #473?

Are there more files we should be concerned about?

[florian-nolte]

Thank you so much for fixing this so quickly!

As for other files or folders that should not be blocked by default, I'm not aware of any. However, I'm not an expert in this area.

I'm looking forward to seeing #473 merged.

Regarding the broader question of whether hidden files should be blocked by default: I'd love to see a consistent approach across the different web server variants. One of the key strengths of this project is how it allows you to easily switch between web servers by simply changing the image.

[jaydrogers]

Shipping it now 😃 https://github.com/serversideup/docker-php/releases/tag/v3.4.4

Here's the action to watch: https://github.com/serversideup/docker-php/actions/runs/11406644032

Thanks for reporting this @florian-nolte and I greatly appreciate the prompt fix @jpangborn!