Nginx Try_Files Redirection Loop Auditor

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 10 mins

TL;DR

• What broke: try_files is falling back to a URI that re-enters the same location block, creating an infinite internal redirect until Nginx hits recursive_error_pages or worker connection limits and throws HTTP 500.
• How to fix it: The fallback (last) argument in try_files must be a named location (@fallback) or a direct file path — never a URI that matches the current location block.
• Use the Client-Side Sandbox above to paste your nginx.conf and auto-refactor the try_files chain without leaking your config to a third-party server.

2024/01/15 03:42:17 [error] 1234#1234: *998 rewrite or internal redirection cycle
while internally redirecting to "/index.php", client: 10.0.0.1,
server: app.internal, request: "GET /missing-page HTTP/1.1"

How to Fix It (The Solution)

Root Cause

try_files $uri $uri/ /index.php — the final fallback /index.php is a URI rewrite, not a named location. If the location block that catches /index.php is the same block (or a block that itself calls try_files again), Nginx loops.

Basic Fix — Use a Named Location as the Fallback

 server {
     listen 80;
     server_name app.internal;
     root /var/www/html;
     index index.php index.html;
 
     location / {
-        try_files $uri $uri/ /index.php;
+        try_files $uri $uri/ @php_fallback;
     }
 
+    location @php_fallback {
+        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+        include fastcgi_params;
+    }
 
     location ~ \.php$ {
         fastcgi_pass unix:/run/php/php8.2-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         include fastcgi_params;
     }
 }

Named locations (@php_fallback) are terminal — Nginx does not re-evaluate location matching from them, breaking the cycle by design.

Enterprise Best Practice — Explicit SCRIPT_FILENAME + Separate Ingress Routing

For production environments behind a load balancer or Kubernetes Ingress:

 location / {
-    try_files $uri $uri/ /index.php?$query_string;
+    try_files $uri $uri/ @rewrite_fallback;
 }
 
+location @rewrite_fallback {
+    # Explicitly pass to FPM with a hardcoded entry point.
+    # Never use $uri here — that re-introduces the cycle risk.
+    internal;
+    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
+    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+    fastcgi_param QUERY_STRING $query_string;
+    fastcgi_param REQUEST_URI $request_uri;
+    include fastcgi_params;
+}
 
 # Deny direct .php execution outside of the named location
 location ~ \.php$ {
+    # Only reachable via explicit file match, not fallback
     try_files $fastcgi_script_name =404;
     fastcgi_pass unix:/run/php/php8.2-fpm.sock;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     include fastcgi_params;
 }

The internal directive on the named location ensures it cannot be hit by external requests directly — tightening the attack surface while eliminating the loop.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .github/workflows/nginx-lint.yml
- name: Validate Nginx Config
  run: |
    docker run --rm \
      -v ${{ github.workspace }}/nginx:/etc/nginx:ro \
      nginx:alpine nginx -t

pip install gixy
gixy /etc/nginx/nginx.conf
# PROBLEM: [try_files] Possible internal redirect loop detected

# policy/nginx_try_files.rego
package nginx

deny[msg] {
  block := input.servers[_].locations[_]
  try_files := block.try_files
  # Last argument must start with @ (named location) or be =CODE
  last_arg := try_files[count(try_files)-1]
  not startswith(last_arg, "@")
  not startswith(last_arg, "=")
  msg := sprintf("try_files last argument '%v' is a URI fallback — use a named location to prevent redirect loops.", [last_arg])
}

# In your smoke test suite post-deploy
HTTP_CODE=$(curl -o /dev/null -s -w "%{http_code}" https://app.internal/nonexistent-path-$(date +%s))
if [ "$HTTP_CODE" = "500" ]; then
  echo "FATAL: 500 on non-existent path — possible try_files loop. Check Nginx error log."
  exit 1
fi