-
Notifications
You must be signed in to change notification settings - Fork 6.3k
nginx config minor bug fixed #4312
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
without ^~, resources in folders like /static cannot be accessed.
@bpmct or @code-asher could you review this? I haven't used nginx so not sure I can help much here.
Codecov Report
@@ Coverage Diff @@ ## main #4312 +/- ## ========================================== + Coverage 68.09% 68.22% +0.12% ========================================== Files 31 31 Lines 1586 1586 Branches 308 308 ========================================== + Hits 1080 1082 +2 + Misses 432 430 -2 Partials 74 74
Continue to review full report at Codecov.
|
without ^~, I'll encounter 404 responces when the code server page tries to access resources with the uri like /static/b37ff28a0a582aee84a8f961755d0cb40a4081db/usr/lib/code-server/vendor/modules/code-oss-dev/out/vs/workbench/workbench.web.api.nls.js (and it is a usual case in the default setting).
after adding ^~, it began working.
Another option is add a same block with / changed to /static, which also works.
jawnsy
commented
Oct 7, 2021
It's always better IMO to avoid using regular expressions as they are harder to maintain (harder for developers to read/understand) and can also lead to reDOS vulnerabilities. If we can duplicate a block in the config to achieve the same behavior, I think that's a preferable solution
okay, I changed by duplicating the block for /static.
If we can duplicate a block in the config to achieve the same behavior, I think that's a preferable solution
Good call! @code-asher I'll let you give the final approval here
server_name _; location / { proxy_pass http://localhost:8080/; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Accept-Encoding gzip; }
It works in localhost address
user@server:~$ curl -D - http://localhost/static/b37ff28a0a582aee84a8f961755d0cb40a4081db/usr/lib/code-server/vendor/modules/code-oss-dev/out/vs/workbench/workbench.web.api.js
HTTP/1.1 200 OK
Server: nginx
Date: 2021年10月10日 11:31:35 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=31536000
ETag: W/"92590f-QMJQGw95m3noobzbN86uvuHM308"
Vary: Accept-Encoding
Content-Encoding: gzip
Now I use the similar conf on my domain (from /etc/nginx/conf.d/default.conf):
server {
#listen 80;
#listen [::]:80;
listen 443 ssl http2;
server_name aaa.snorl.ax;
ssl_certificate /etc/letsencrypt/live/snorl.ax/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/snorl.ax/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/snorl.ax/chain.pem;
include security.conf;
include general.conf;
#root /var/www/example.com;
#index index.html;
#error_page 400 502 /404.html;
location / {
proxy_pass http://localhost:8080/;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
}
}
Then:
user@server:~$ curl -D - https://aaa.snorl.ax/static/b37ff28a0a582aee84a8f961755d0cb40a4081db/usr/lib/code-server/vendor/modules/code-oss-dev/out/vs/workbench/workbench.web.api.js
HTTP/2 404
server: nginx
date: 2021年10月10日 12:03:52 GMT
content-type: text/html; charset=utf-8
content-length: 146
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>
Now I add ^~ (from /etc/nginx/conf.d/default.conf):
server {
#listen 80;
#listen [::]:80;
listen 443 ssl http2;
server_name aaa.snorl.ax;
ssl_certificate /etc/letsencrypt/live/snorl.ax/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/snorl.ax/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/snorl.ax/chain.pem;
include security.conf;
include general.conf;
#root /var/www/example.com;
#index index.html;
#error_page 400 502 /404.html;
location ^~ / {
proxy_pass http://localhost:8080/;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
}
}
Then:
user@server:~$ curl -D - https://aaa.snorl.ax/static/b37ff28a0a582aee84a8f961755d0cb40a4081db/usr/lib/code-server/vendor/modules/code-oss-dev/out/vs/workbench/workbench.web.api.js
HTTP/2 200
server: nginx
date: 2021年10月10日 12:16:30 GMT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
etag: W/"92590f-QMJQGw95m3noobzbN86uvuHM308"
vary: Accept-Encoding
content-encoding: gzip
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
strict-transport-security: max-age=31536000; includeSubDomains; preload
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
I tested the duplicated one (too long so I didn't added to this paragraph), it just didn't work. So basically ^~ is the only solution.
@SnorlaxYum were you able to try @code-asher's suggestion? Hoping we can either close or move forward!
@SnorlaxYum we haven't heard from you in a couple days so I'm going to assume you fixed your issue. I'm going to close this PR. If you want to discuss getting this in, feel free to open an issue and we'll work with you!
without
^~, resources in folders like/staticcannot be accessed.So I do this PR. It's a minor one in the doc. So I think there's no need to create an issue for it.