SmartCJ Wiki

User Tools

Site Tools

Trace:
nginx

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
nginx [2024/05/27 08:51] – [Nginx] adminnginx [2026/03/21 10:11] (current) – external edit 127.0.0.1
Line 1: Line 1:
 +====== Nginx ======
 +
 +Nginx is a fast HTTP server, generally faster than Apache, known for efficient request handling and minimal overhead. It's commonly used for serving static content.
 +
 +A popular modern setup is the nginx\Apache combination.
 +
 +Nginx (faster) handles all incoming connections and serves static content, while script requests forward to Apache. This approach significantly speeds things up when you serve both scripts and static content from the same server.
 +
 +===== Error 1 =====
 +
 +There's an issue with IP logging: when nginx forwards a request to Apache, Apache sees 127.0.0.1 (localhost) by default, not the actual user IP. Some setups cause Apache to see the server IP instead, making the script think all traffic comes from one IP, which triggers IP-based protection and stops counting hits.
 +
 +You'll see this error: "Nginx <-> Apache ERROR $_SERVER[SERVER_ADDR] == $_SERVER[REMOTE_ADDR], please contact admin." when you open the home page.
 +
 +To fix it: Ask your admin to install the mod_realip module for Apache and configure nginx to pass the real IP in the X_REAL_IP header.
 +
 +To verify: Open /scj/admin/test.php. The REMOTE_ADDR field should show your actual IP, not the server IP or 127.0.0.1.
 +
 +===== Error 2 =====
 +
 +Another issue occurs when the visitor IP appears in both REAL_IP and HTTP_FORWARDED_FOR headers.
 +
 +Check this: Open /scj/admin/test.php. If you see your IP in the HTTP_FORWARDED_FOR field, this is the problem.
 +
 +SmartCJ interprets HTTP_FORWARDED_FOR as a proxy indicator, so it incorrectly classifies all traffic as coming from proxies.
 +
 +To fix: Ask your admin to ensure the IP is passed only in REAL_IP, not HTTP_FORWARDED_FOR.
 +
 +To verify: Open /scj/admin/test.php. You should see:
 +- REMOTE_ADDR: your actual IP
 +- REAL_IP: your actual IP
 +- SERVER_ADDR: server IP (different from your IP)
 +- HTTP_FORWARDED_FOR: absent
 +
 +
 +
 +
 +Result: if you open /scj/admin/test.php then it should be
 +  * REMOTE_ADDR - your IP
 +  * SERVER_ADDR (SERVER_IP) - server IP
 +  * HTTP_FORWARDED_FOR (or HTTP_X_FORWARDED_FOR) should not be present
 +
 +
 +
 +===== Admin password =====
 +
 +By default, admin access uses Apache's basic authentication (.htaccess), but nginx doesn't read .htaccess files. You have two options:
 +
 +**Option 1** - Enable "Switch to multiaccess" in the admin panel. The panel will ask for a password, but backup directories and other sensitive folders remain web-accessible and can be downloaded. Option 2 is recommended.
 +
 +**Option 2** - Ask your admin to add authentication rules to the nginx config:
 +
 +<code>
 +
 +location /scj/admin/files/ {
 +    deny all;
 +}
 +
 +location /scj/logs/ {
 +    deny all;
 +}
 +
 +location /scj/data/ {
 +    deny all;
 +}
 +
 +location /scj/backup/ {
 +    deny all;
 +}
 +
 +location /scj/admin/ {
 +    auth_basic "Admin Zone";
 +    auth_basic_user_file /home/user/www/$domain/scj/admin/.htpasswd;
 +}
 +
 +location ~* /scj/admin/(.*)\.php$ {
 +    index index.php;
 +    auth_basic "Admin Zone";
 +    auth_basic_user_file /home/user/www/$domain/scj/admin/.htpasswd;
 +}
 +
 +</code>
 +
 +===== Nginx password error =====
 +
 +Three password methods are available:
 +
 +- **.htaccess** - An Apache config file. When you request a file from a directory with .htaccess, Apache reads it first. The admin panel uses Apache basic auth by default, which references a .htpasswd file.
 +- **Script-based (Option 2)** - scj/admin/index.php asks for a password (used with multi-access).
 +- **Nginx-based (Option 3)** - Nginx requests a password using .htpasswd (like the example above).
 +
 +A common mistake is mixing methods: you set Option 3 (nginx password "password1") while also enabling Option 2 (script password "password2"). Since browsers only have one password prompt, entering one fails the other authorization.
 +
 +Solution: Use only one method.