Laravel + NGINX giving 403 forbidden

Question

I am really stuck loading a Laravel app for the first time on the web (EC2).

I have an instance of Ubuntu 18.04 running latest laravel 5.6. I have been stuck for hours trying to resolve a 403 issue. I have followed:

These steps (create new group, add ubuntu and www-data to it, set group and owner to read, write and execute)

These steps to set folder permissions

... many other attempts / server rebuilds...

So just now I set all files and folders in root to 777 to test

$ find /home/ubuntu/projectname -type f -exec chmod 777 {} \;
$ find /home/ubuntu/projectname -type d -exec chmod 777 {} \;

And on suggestion below I also did this:

$ namei -l /home/ubuntu/projectname/public
f: /home/ubuntu/projectname/public
drwxr-xr-x root     root     /
drwxr-xr-x root     root     home
drwxr-xr-x ubuntu   ubuntu   ubuntu
drwxrwxrwx www-data www-data projectname
drwxrwxrwx www-data www-data public

$ sudo chmod -R 777 /home/ubuntu/projectname

$ ls -l
drwxrwxrwx   8 www-data www-data   4096 Aug 16 10:25 app
-rwxrwxrwx   1 www-data www-data   1686 Aug 16 10:25 artisan
drwxrwxrwx   3 www-data www-data   4096 Aug 16 10:25 bootstrap
-rwxrwxrwx   1 www-data www-data   1652 Aug 16 10:25 composer.json
-rwxrwxrwx   1 www-data www-data 166078 Aug 16 10:25 composer.lock
drwxrwxrwx   2 www-data www-data   4096 Aug 16 10:25 config
drwxrwxrwx   5 www-data www-data   4096 Aug 16 10:25 database
drwxrwxrwx 999 www-data www-data  36864 Aug 16 10:46 node_modules
-rwxrwxrwx   1 www-data www-data   1442 Aug 16 10:25 package.json
-rwxrwxrwx   1 www-data www-data 604905 Aug 16 10:45 package-lock.json
-rwxrwxrwx   1 www-data www-data   1134 Aug 16 10:25 phpunit.xml
drwxrwxrwx   6 www-data www-data   4096 Aug 16 10:46 public
-rwxrwxrwx   1 www-data www-data   3675 Aug 16 10:25 readme.md
drwxrwxrwx   6 www-data www-data   4096 Aug 16 10:25 resources
drwxrwxrwx   2 www-data www-data   4096 Aug 16 10:25 routes
-rwxrwxrwx   1 www-data www-data    563 Aug 16 10:25 server.php
drwxrwxrwx   6 www-data www-data   4096 Aug 16 10:25 storage
drwxrwxrwx   4 www-data www-data   4096 Aug 16 10:25 tests
drwxrwxrwx  45 www-data www-data   4096 Aug 16 10:45 vendor
-rwxrwxrwx   1 www-data www-data   1738 Aug 16 10:25 webpack.mix.js

This last one has me stumped as the result is the same in my nginx project error log (tail -f):

2018/08/16 13:44:25 [error] 27246#27246: *1 directory index of "/home/ubuntu/projectname/public/" is forbidden, client: 29.99.0.232, server: projectname.com.au, request: "GET / HTTP/1.1", host: "projectname.com.au"

I do not know what to try next. Any help will get you on my Christmas card list!

My project is cloned to:

/home/ubuntu/projectname

My nginx config (taken from Laravel's Deploy page) is:

server {
    listen 80;

    server_name projectname.com.au www.projectname.com.au;
    root /home/ubuntu/projectname/public;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    index index.html index.htm index.php;

    charset utf-8;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    error_page 404 /index.php;

    access_log  /var/log/nginx/projectname.access.log;
    error_log  /var/log/nginx/projectname.error.log error;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/projectname.com.au/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/projectname.com.au/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server {
    if ($host = www.projectname.com.au) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = projectname.com.au) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        server_name projectname.com.au www.projectname.com.au;
    return 404; # managed by Certbot
}

Answer 1

Try changing this line in the Nginx config:

location / {
    try_files $uri $uri/ /index.php?$query_string;
}

to this:

location / {
   try_files $uri /index.php?$query_string;
}

From what I can see, this is caused because nginx will try to index the directory, and be blocked by itself.

Source answer: Nginx 403 error: directory index of [folder] is forbidden

Answer 2

There might be permission problems for nginx somewhere else along the path to the root directory.

Run namei -l /home/ubuntu/projectname/public and make sure, that every directory has atleast execute permissions to the nginx user.

Answer 3

I had to run single site on my server and without creating any other virtual host so I just updated the default config of nginx file and it worked for me.

Let me share the steps and changes I did.

First go to /var/www/html/ and create your project What I did is created the project name with wwwroot to work without error. You can also add a new project there with your project name.

So my project was directly inside wwwroot folder.

In /etc/nginx/sites-available

nano default

I added one more text in this line from this

location / {
     index  index.php index.html index.htm hostingstart.html;  
}

to this

location / {
     index  index.php index.html index.htm hostingstart.html public;  
}

I added public folder inside the location because laravel's index file is located inside public directory.

But if you want to add a project name inside wwwroot folder you can add location name as project_name/public and it will work.

Make sure to restart your nginx server with command service nginx restart after above changes are done.

It worked for me in azure app service which only supports nginx for php8