order of locations with regular expressions

[openid.yandex.ru/dyadyamax]

steps:

1. setup 2 rules:

~
location ~ /\. { deny all; }
location ~* \.(php|pl|py)$ { include php-fpm_proxy; }
~

2. send request "​http://my_host/.z/foo"
3. send request "​http://my_host/.z/index.php"

expect to happen: both request result = 403 forbidden

actually happens:

2. = 403 forbidden
3. result of executed script

But your help has: "Then regular expressions are checked, in the order of their appearance in a configuration file. A search of regular expressions terminates on the first match, and the corresponding configuration is used."
​http://nginx.org/en/docs/http/ngx_http_core_module.html#location

[Maxim Dounin]

Works ok here. Could you please provide *full* config to reproduce the problem? I.e. minimal self-consistent nginx.conf needed, something like this:

events {}
http {
    server {
        listen 8080;
        location ~ /\. { deny all; }
        location ~* \.(php|pl|py)$ { return 200 "php"; }
    }
}

The above config correctly returns 403 for both "/.z/foo" and "/.z/index.php" requests here:

127.0.0.1 - - [17/May/2012:16:44:05 +0400] "GET /.z/foo HTTP/1.0" 403 168 "-" "-"
127.0.0.1 - - [17/May/2012:16:44:12 +0400] "GET /.z/index.php HTTP/1.0" 403 168 "-" "-"

[openid.yandex.ru/dyadyamax]

here is all 'location's for my site:

location ~ /\. { include vhosts/subconf/allow_no_one;  }
location ^~ /tmp/!private/ { include vhosts/subconf/allow_no_one; }
location ^~ /!x-zone/ { include vhosts/subconf/allow_admins; }
location ^~ /pages/ { include vhosts/subconf/php-fpm_proxy;  }

location /direct/       { access_log off; }
location /tmp/public/   { access_log off; }


# deny from access to .ht*-files
location ~ /\.ht[a-z]+$ {
	access_log off;
	deny all;
}

# direct access to images, css, javascript and archives
location ~* /[^/]+\.(jpg|jpeg|gif|png|ico|css|bmp|swf|js|gz|zip|rar|txt|html|xml)$ {
	access_log off;
}

# direct access to scripts
location ~* \.(php|pl|py|jsp|sh|bash|c|cgi)$ {
	include vhosts/subconf/php-fpm_proxy;
}

location / {
	include vhosts/subconf/php-fpm_proxy;
}

[Maxim Dounin]

Which requests do you use in actual testing? What's in logs for these requests? And again: it's really good idea to provide self-consistent config and logs produced with it, as show in my first reply.

[openid.yandex.ru/dyadyamax]

You can close this ticket as bogus.
My mistake. On every change in config I did:

1. nginx -t -c "new config"
2. "kill -HUP", if previous was without errors.

First command, in my case, did not talk about any errors, but second did not reloaded config, because of errors... In result I always checked old config :/

[Maxim Dounin]

Ok, closing this as invalid.