X-Accel-Redirect and "access forbidden by rule"

Fri Dec 2 13:55:42 UTC 2011

I'm having an issue with turning on support for the X-Accel-Redirect
header in DokuWiki, a php-based wiki application. The server in question
is an Ubuntu 11.10 box with Nginx 1.0.10 and PHP-FPM 5.3.6-13. I posted
a request for assistance on the DokuWiki forums, since obviously they're
the best suited to help if the problem is with their application, but I
wanted to also try the mailing list and see if the Nginx community could
suggest a direction I could go in.

DokuWiki has a configuration option to enable serving static content
using either X-Sendfile or X-Accel-Redirect, and since the site has more
than a few images, I wanted to toggle it on. When I do this and reload a
page, I get a page without any CSS or images, and the nginx error.log
file shows lots of "access forbidden by rule" errors, both for the CSS
file and for the various image files, like this:

----------
2011/11/08 21:01:23 [error] 6693#0: *12 access forbidden by rule,
client: 10.10.10.110, server: www.bigdinosaur.org, request: "GET
/mcwiki/lib/exe/css.php?t=vector&tseed=1320807658 HTTP/1.1", upstream:
"fastcgi://unix:/var/run/php5-fpm.soc:", host: "www.bigdinosaur.org",
referrer: "http://www.bigdinosaur.org/mcwiki/wiki:genesis_base"

...

2011/11/08 21:01:23 [error] 6693#0: *12 access forbidden by rule,
client: 10.10.10.110, server: www.bigdinosaur.org, request: "GET
/mcwiki/_media/wiki:gb:gb-entrance.jpg?w=500 HTTP/1.1", upstream:
"fastcgi://unix:/var/run/php5-fpm.soc:", host: "www.bigdinosaur.org",
referrer: "http://www.bigdinosaur.org/mcwiki/wiki:genesis_base"
----------

When I look at the headers being sent by the server for each request, I
don't see anything about X-Accel-Redirect, but that might be because the
content isn't being served in the first place. Here's what the headers
for each request look like:

----------
GET /mcwiki/_media/wiki:gb:gb-entry.jpg?w=300 HTTP/1.1
Host: www.bigdinosaur.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:7.0.1)
Gecko/20100101 Firefox/7.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
DNT: 1
Connection: keep-alive
Referer: http://www.bigdinosaur.org/mcwiki/wiki:genesis_base
Cookie: (redacted)
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Nov 2011 03:04:26 GMT
Content-Type: text/html
Last-Modified: Mon, 07 Nov 2011 23:50:45 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 10 Nov 2011 03:04:26 GMT
Cache-Control: public, proxy-revalidate, no-transform, max-age=86400
Content-Disposition: inline;
filename="1d2bb3508bcd870b387232726c81cd22.media.300x169.jpg";
Content-Encoding: gzip
----------

I've read through the X-Accel docs as best as I can, and I think that
the problem might be that I have no explicitly defined "location"
setting for the specific directories that the images and css files are
stored in, since they are in subdirectories underneath the main Dokuwiki
root (which does have a location definition).

I also can't understand from the docs if X-Accel can only be used on
files whose location is explicitly marked "internal"--the page on the
nginx wiki says they "should" be, and various other pages on the web
offer contradictory advice.

Making the issue more complex: one of the URIs referenced in the two
requests above, "/mcwiki/_media/", is being rewritten to make it look
prettier. Here's the relevant rewrite rule:

----------
rewrite ^/mcwiki/_media/(.*) /mcwiki/lib/exe/fetch.php?media=$1 last;
----------

Dokuwiki resizes and caches images in a cache directory, and the
"fetch.php" file includes some logic to tell Dokuwiki if the image it's
being asked to serve needs to be sent from the main images directory, or
from the cache directory. That's why in the header traffic I pasted
above the filename looks nothing like what's being asked for in the GET
request.

My first thought was that the rewrite rules were somehow screwing things
up, so I removed all of them. However, the "access forbidden" problem
remained, with the error messages simply changing to show the
non-rewritten URI instead of the prettier one:

----------
2011/11/08 17:11:57 [error] 5124#0: *130 access forbidden by rule,
client: 10.10.10.110, server: www.bigdinosaur.org, request: "GET
/mcwiki/lib/exe/fetch.php?w=300&media=wiki:gb:gb-sublevel.png HTTP/1.1",
upstream: "fastcgi://unix:/var/run/php5-fpm.soc:", host:
"www.bigdinosaur.org", referrer:
"http://www.bigdinosaur.org/mcwiki/doku.php?id=wiki:grande_grinder"
----------

I then thought that perhaps the problem is that there's no explicit
location definition for the "/mcwiki/lib/exe" directory or for the
"/mcwiki/_media" rewritten location, so I added them into the site
config along with a "root" entry for each, and flagged them as
"internal" in case X-Accel-Redirect requires that. However, this just
caused every request to return a 404 response. Removing the "internal"
flag led to more 404s, so I removed the definitions.

Sorry for the long-winded message, but I wanted to get as much info in
as possible. Things are working just fine without X-Accel turned on, so
worst case I could just leave it off and continue on. However, I'd like
to enable it, as there are quite a few images on the wiki and serving
them directly out rather than making php-fpm do it could speed things
up. Any assistance would be appreciated!

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,219485,219485#msg-219485