id summary reporter owner description type status priority milestone component version resolution keywords cc uname nginx_version 2103 First declared upstream site returns 403 forbidden when used with proxy_pass dant89@… "I have a versioned API with two separate repository file paths, I'm trying to use location matching combined with proxy_path to route to the applicable upstream server. All of the paths work apart from the root path for the first upstream server, for example: Works: - api.com/api/v1/endpoint - 200 response - api.com/api/v2 - 200 response - api.com/api/v2/endpoint - 200 response Does not work: - api.com/api/v1 - 403 Forbidden For some reason the non working URL returns a 301, redirects to the same url with a slash on the end and then looks in the wrong location for the file. This seems strange because other URLs such as api/v1/endpoint do not do this behaviour and serve from the correct server folder. access log {{{ 127.0.0.1 - - [02/Dec/2020:16:19:09 +0000] ""GET /api/v1 HTTP/1.0"" 301 194 ""-"" ""Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"" 127.0.0.1 - - [02/Dec/2020:16:19:09 +0000] ""GET /api/v1/ HTTP/1.0"" 403 580 ""-"" ""Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"" }}} error log {{{ 2020/12/02 16:19:09 [error] 3286#3286: *7 directory index of ""/srv/api-v1/public/api/v1/"" is forbidden, client: 127.0.0.1, server: api, request: ""GET /api/v1/ HTTP/1.0"", host: ""api"" }}} This is with the following configuration: {{{ upstream v1 { server 127.0.0.1; } upstream v2 { server 127.0.0.1; } server { listen 443 http2; listen [::]:443 http2; server_name api.com; location /api/v1 { proxy_pass http://v1; } location /api/v2 { proxy_pass http://v2; } } server { server_name v1; root /srv/api-v1/public/; location / { try_files $uri $uri/ /index.php$is_args$args; } location ~ ^/index\.php(/|$) { include /etc/nginx/fastcgi.conf; fastcgi_pass unix:/run/php-fpm-php7.2.socket; fastcgi_split_path_info ^(.+?\.php)(/.*)$; internal; } } server { server_name v2; root /srv/api-v2/public/; location / { try_files $uri $uri/ /index.php$is_args$args; } location ~ ^/index\.php(/|$) { include /etc/nginx/fastcgi.conf; fastcgi_pass unix:/run/php-fpm-php7.2.socket; fastcgi_split_path_info ^(.+?\.php)(/.*)$; internal; } } }}} I have documented the issue here in the *Attempted fix* section: https://stackoverflow.com/questions/65093486/nginx-alias-breaks-due-to-try-files-uri-alias-bug" defect closed major nginx-core 1.14.x invalid Linux censored.net 4.15.0-124-generic #127-Ubuntu SMP Fri Nov 6 10:54:43 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux "nginx version: nginx/1.14.0 (Ubuntu) built with OpenSSL 1.1.1 11 Sep 2018 TLS SNI support enabled configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-GkiujU/nginx-1.14.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-headers-more-filter --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-cache-purge --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-ndk --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-echo --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-fancyindex --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/nchan --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-lua --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/rtmp --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-uploadprogress --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx-GkiujU/nginx-1.14.0/debian/modules/http-subs-filter "