I am using nginx as a reverse proxy for PHP with PHP-FPM. I'm using the following configuration:
server { listen 80; root /var/www/html; index index.php; error_page 403 /error-403; error_page 404 /error-404; location ~ \.php$ { if ($http_x_forwarded_proto = 'https') { set $fe_https 'on'; } try_files $uri =400; include fastcgi_params; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS $fe_https; fastcgi_pass php:9000; } } I'm using the try_files directive, as recommended, for preventing uncontrolled requests to PHP.
However, after doing some testing, the try_files doesn't seem to do anything. If I request a URL with a non-existing .php file (like /no-file.php), I get a 404 error from PHP. Instead, I would expect a 400 error from nginx.
Am I missing something? The try_files doesn't seem to do anything.
