Refactor and improve security headers, file blocks, etc #631

marns93 · 2025-12-16T09:34:34Z

Important

This PR was co-authored by @jaydrogers and had it's original comment modified to provide the latest summary. View the original post by @marns93 below if you'd like to see the content of the original submission

Testing this PR

You can test this PR by using any tag with this prefix:

docker.io/serversideup/php-dev:631-*

View related images →

Summary

This PR standardizes and improves security configurations across nginx, Apache, and FrankenPHP/Caddy variations to ensure consistent behavior and proper documentation with references to authoritative sources.

Authoritative Sources Referenced

All configurations now cite their sources for transparency and credibility:

Source	URL
H5BP Server Configs (nginx)	https://github.com/h5bp/server-configs-nginx
H5BP Server Configs (Apache)	https://github.com/h5bp/server-configs-apache
OWASP Secure Headers Project	https://owasp.org/www-project-secure-headers/
RFC 8615 - Well-Known URIs	https://www.rfc-editor.org/rfc/rfc8615

Security Headers (Consistent Across All Variations)

Header	Value	Purpose
`X-Frame-Options`	`SAMEORIGIN`	Prevent clickjacking attacks
`X-Content-Type-Options`	`nosniff`	Prevent MIME type sniffing
`Referrer-Policy`	`strict-origin-when-cross-origin`	Control referrer information
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains`	Enforce HTTPS (HSTS)

Blocked File Extensions

Based on H5BP server configs with a conservative approach to avoid breaking legitimate use cases:

Extension	Reason
`.bak`	Backup files
`.conf`	Configuration files (Linux/Unix)
`.config`	Configuration files (Windows/.NET)
`.dist`	Distribution/sample configs
`.inc`	PHP include files
`.ini`	Configuration files
`.log`	Log files
`.sh`	Shell scripts
`.sql`	Database dumps
`.swp` / `.swo`	Vim swap files
`~`	Editor backup files
`#*#`	Emacs auto-save files
`/.`	All dotfiles (hidden files)

✅ Explicitly Allowed

/.well-known/* - Required by RFC 8615 for ACME challenges other standardized endpoints

❌ Intentionally NOT Blocked (too aggressive for general use)

.zip, .tar, .tgz - Legitimate downloads
.yml, .json - Could be API responses
.psd, .fla - Low security risk

Key Changes from Previous Configuration

Standardized blocklist - All three variations now block the same file extensions
Added .well-known exception - Properly allows RFC 8615 endpoints (fixes FrankenPHP returns 403 for commonly used hidden folders like .well-known/ #626)
Added .conf blocking - More relevant for Linux/PHP environments than .config alone
Removed arbitrary extensions - .fla, .psd, .orig, .inci, .swop removed (not in official H5BP or too aggressive)
Consistent Referrer-Policy - Changed to strict-origin-when-cross-origin across all variations
Added source documentation - Every rule now cites its authoritative source

Testing Checklist

Verify /.well-known/ paths are accessible (ACME, security.txt, etc.)
Verify blocked extensions return 403
Verify security headers are present in responses
Test with legitimate .zip downloads (should work)

Original post by @marns93

Fixes: #626

The newest variation frankenphp is blocking everything under .well-known/. The following line is responsible for this

docker-php/src/variations/frankenphp/etc/frankenphp/Caddyfile

Line 131 in 9b6868e

@rejected path *.bak *.conf *.dist *.fla *.ini *.inc *.inci *.log *.orig *.psd *.sh *.sql *.swo *.swp *.swop */.*

In this PR I've whitelisted some commonly used paths under .well-known/. For security reasons I don't want to allow everything, so I've whitelisted some of them. The list can be extended in the future.

jaydrogers · 2025-12-16T14:13:07Z

Thanks for the PR! I will review soon 👍

wapacro · 2026-01-06T14:42:11Z

Great PR, running into this issue right now. However, I'd add some more common endpoints for web apps, at least .well-known/passkey-endpoints and .well-known/webauthn (for proper Passkey support) if not all of them.

marns93 · 2026-01-09T12:56:15Z

Great PR, running into this issue right now. However, I'd add some more common endpoints for web apps, at least .well-known/passkey-endpoints and .well-known/webauthn (for proper Passkey support) if not all of them.

@wapacro Thank you for your feedback. I've added your endpoints in this PR.
In general I do agree, but I would make the whitelist explicitly based on requests.

marns93 · 2026-01-09T12:57:07Z

@jaydrogers Any estimation when this can be reviewed and merged on your side?

Maarten-Dekker · 2026-01-13T18:18:51Z

Could we also include support for .well-known/ucp? The UCP spec (https://ucp.dev) defines this as the standard discovery endpoint.

…ing-well-known-path

…lowed

…plementing best practices for HTTP headers and file access restrictions. Added protections against clickjacking, MIME type sniffing, and sensitive file exposure while allowing necessary access to well-known URIs as per RFC 8615.

jaydrogers · 2026-01-14T22:09:15Z

@marns93 I appreciate your efforts on this.

I had a chance to take a look at your PR. Instead of blocking everything from .well-known and whitelisting it, I changed the rules to specifically allow anything in .well-known because it's and industry standard to allow any files in there.

I also standardized these rules across all 3 web server variations.

I am keeping an updated summary here: #631 (comment)

jaydrogers · 2026-01-15T19:21:35Z

Thanks for your contribution! I confirmed functionality in my local testing and this should be available in the next release

marns93 · 2026-01-16T09:43:42Z

Thanks for your contribution! I confirmed functionality in my local testing and this should be available in the next release

I've doubled checked and can confirm the functionality.

* Fix blocking .well-known path for FrankenPHP * Remove specific endpoint checks because the whole folder should be allowed * Enhance security configurations across Apache, NGINX, and Caddy by implementing best practices for HTTP headers and file access restrictions. Added protections against clickjacking, MIME type sniffing, and sensitive file exposure while allowing necessary access to well-known URIs as per RFC 8615. --------- Co-authored-by: Jay Rogers <3174134+jaydrogers@users.noreply.github.com> Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net>

…atabase connection checks (#628) * Refactor Laravel migration script to improve isolation handling and database connection checks - Removed migration isolation argument from test-db-connection script. - Introduced a helper function for running migrations per database, enhancing clarity and reusability. - Updated migration flag assembly logic to better manage isolation settings. - Improved error handling and logging for database connection issues. * Remove debug log from Laravel migration script to streamline output during migrations * Update Laravel migration script to change error message from error to warning for version check * Update PHP base opertating systems. Add Alpine 3.23 support (#638) PHP repo no longer has images available for alpine3.21 for latest minor versions, this removes 3.21 if its no longer available and adds 3.23 if available * Update PHP extension installer version to 2.9.27 * Update NGINX version to 1.28.1 * Refactor and improve security headers, file blocks, etc (#631) * Fix blocking .well-known path for FrankenPHP * Remove specific endpoint checks because the whole folder should be allowed * Enhance security configurations across Apache, NGINX, and Caddy by implementing best practices for HTTP headers and file access restrictions. Added protections against clickjacking, MIME type sniffing, and sensitive file exposure while allowing necessary access to well-known URIs as per RFC 8615. --------- Co-authored-by: Jay Rogers <3174134+jaydrogers@users.noreply.github.com> Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net> * Update GitHub Actions to use actions/checkout@v6 in multiple workflows * Update GitHub Actions to use actions/upload-artifact@v6 for improved artifact handling * Update GitHub Actions to use actions/download-artifact@v7 for improved artifact handling * Upgrade FrankenPHP to v1.11.1 * Increase size of GitHub Actions Runners because of memory segmentation fault issues (Thanks Depot! 😅) * Add security measures to block PHP execution in storage directory (#641) Implemented restrictions across Apache, NGINX, and FrankenPHP configurations to prevent the execution of PHP files in the /storage directory, addressing potential vulnerabilities related to arbitrary file uploads (GHSA-29cq-5w36-x7w3). * Refactor Laravel version check and isolation mode handling in automation script - Updated the logic for enabling isolation mode based on Laravel version, ensuring it only activates for versions 9.38.0 and above. - Improved error handling and logging for Laravel version detection, providing clearer output when version determination fails. - Simplified version comparison logic to enhance readability and maintainability. * Update container info script to include automation status --------- Co-authored-by: alloylab <trevor@alloylab.com> Co-authored-by: Marcel Arns <38068686+marns93@users.noreply.github.com>

Fix blocking .well-known path for FrankenPHP

00df1ca

marns93 force-pushed the fix-blocking-well-known-path branch from d7aed51 to 00df1ca Compare January 9, 2026 12:54

jaydrogers added this to serversideup/php: v4.3 Jan 13, 2026

github-project-automation bot moved this to Todo in serversideup/php: v4.3 Jan 13, 2026

jaydrogers changed the base branch from main to release/bugfixes-and-dependency-updates January 14, 2026 19:47

jaydrogers and others added 2 commits January 14, 2026 13:47

Merge branch 'release/bugfixes-and-dependency-updates' into fix-block…

73b42d3

…ing-well-known-path

Remove specific endpoint checks because the whole folder should be al…

41f70d1

…lowed

jaydrogers changed the title ~~Fix blocking .well-known path for FrankenPHP~~ Refactor and improve security headers, file blocks, etc Jan 14, 2026

jaydrogers merged commit 7a1b6b9 into serversideup:release/bugfixes-and-dependency-updates Jan 15, 2026
83 checks passed

github-project-automation bot moved this from Todo to Done in serversideup/php: v4.3 Jan 15, 2026

This was referenced Jan 15, 2026

Release 4.3: Bug Fixes, Security Improvements, and Depdendency Updates #639

Merged

FrankenPHP returns 403 for commonly used hidden folders like .well-known/ #626

Closed

jaydrogers mentioned this pull request Jan 27, 2026

Referrer policy fix #504

Closed

marns93 deleted the fix-blocking-well-known-path branch January 28, 2026 07:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refactor and improve security headers, file blocks, etc #631

Refactor and improve security headers, file blocks, etc #631

Uh oh!

marns93 commented Dec 16, 2025 •

edited by jaydrogers

Loading

Uh oh!

jaydrogers commented Dec 16, 2025

Uh oh!

wapacro commented Jan 6, 2026

Uh oh!

marns93 commented Jan 9, 2026

Uh oh!

marns93 commented Jan 9, 2026

Uh oh!

Maarten-Dekker commented Jan 13, 2026 •

edited

Loading

Uh oh!

jaydrogers commented Jan 14, 2026

Uh oh!

Uh oh!

jaydrogers commented Jan 15, 2026

Uh oh!

marns93 commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Refactor and improve security headers, file blocks, etc #631

Refactor and improve security headers, file blocks, etc #631

Uh oh!

Conversation

marns93 commented Dec 16, 2025 • edited by jaydrogers Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing this PR

Summary

Authoritative Sources Referenced

Security Headers (Consistent Across All Variations)

Blocked File Extensions

✅ Explicitly Allowed

❌ Intentionally NOT Blocked (too aggressive for general use)

Key Changes from Previous Configuration

Testing Checklist

Original post by @marns93

Uh oh!

jaydrogers commented Dec 16, 2025

Uh oh!

wapacro commented Jan 6, 2026

Uh oh!

marns93 commented Jan 9, 2026

Uh oh!

marns93 commented Jan 9, 2026

Uh oh!

Maarten-Dekker commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jaydrogers commented Jan 14, 2026

Uh oh!

Uh oh!

jaydrogers commented Jan 15, 2026

Uh oh!

marns93 commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

marns93 commented Dec 16, 2025 •

edited by jaydrogers

Loading

Maarten-Dekker commented Jan 13, 2026 •

edited

Loading