服务器Nginx location中内部重定向导致403

error_page 403 /errors/403.html;

location = /errors/403.html {
    internal;
    root /var/www/mysite;
}

# 确保错误页面文件本身可被Nginx进程读取
ls -la /var/www/mysite/errors/403.html
restorecon -v /var/www/mysite/errors/403.html  # SELinux环境

# 验证：直接用curl测试内部路径（应返回404而非403，因为internal禁止外部访问）
curl -I http://localhost/errors/403.html

location / {
    try_files $uri $uri/ /index.html;
}

location ~ \.html$ {
    # 某些安全加固配置可能限制了.html文件的直接访问
    deny all;  # ← 这里就是403的元凶！
}

location / {
    try_files $uri $uri/ @spa_fallback;
}

# 使用命名location避免重新匹配正则规则
location @spa_fallback {
    rewrite ^ /index.html break;
    root /var/www/mysite/public;
}

location /api/v1/ {
    rewrite ^/api/v1/(.*)$ /protected/api/$1 last;
}

location /protected/api/ {
    # 该目录仅允许内网访问
    allow 10.0.0.0/8;
    deny all;
}

location /api/v1/ {
    # 使用break代替last，在当前location内完成重写，不重新匹配
    rewrite ^/api/v1/(.*)$ /protected/api/$1 break;
    proxy_pass http://backend;
}

location /download/ {
    internal;
    alias /data/files/;
}

location /download/ {
    internal;
    alias /data/files/;
    
    # 显式允许的文件类型
    types {
        application/pdf pdf;
        image/png png;
        image/jpeg jpg jpeg;
    }
    
    # 禁止执行任何脚本
    location ~ \.(php|py|sh)$ { deny all; }
}

# 在http或server块中开启
error_log /var/log/nginx/error.log debug;

# 生产环境建议只对特定IP开启，避免日志爆炸
events {
    debug_connection 192.168.1.100;
}

grep -E "(internal redirect|rewrite|test location)" /var/log/nginx/error.log | tail -50

[debug] *1234 test location: "/"
[debug] *1234 using configuration "/api/v1/"
[debug] *1234 rewrite log: "/api/v1/users" -> "/protected/api/users"
[debug] *1234 internal redirect: "/protected/api/users"
[debug] *1234 test location: "/protected/api/"
[debug] *1234 access forbidden by rule, client: x.x.x.x

# 查看详细响应头，确认是否为Nginx返回的403
curl -v http://yourdomain.com/problematic-path

# 如果是后端返回的403，响应头中通常没有Server: nginx标识
# 如果是Nginx返回的403，会有明显的Server头和默认HTML体

location /protected/api/ {
    add_header X-Debug-Location "protected-api-block" always;
    allow 10.0.0.0/8;
    deny all;
}

location @spa_fallback {
    add_header X-Debug-Location "spa-fallback" always;
    rewrite ^ /index.html break;
}

curl -I http://yourdomain.com/dashboard
# X-Debug-Location: protected-api-block  ← 定位到了！

server {
    listen 80;
    server_name app.example.com;
    root /var/www/app/dist;

    # 静态资源正常服务
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    # API代理
    location /api/ {
        proxy_pass http://backend:8080/;
        proxy_set_header Host $host;
    }

    # SPA路由fallback —— 使用命名location，安全可靠
    location / {
        try_files $uri $uri/ @index;
    }

    location @index {
        rewrite ^ /index.html break;
    }

    # 禁止访问隐藏文件
    location ~ /\. {
        deny all;
        internal;  # 防止外部探测
    }
}