PHP-FPM Always Returns 200 Regardless Of NGINX Status Code

Question

I have a PHP-based error page configuration with NGINX and PHP-FPM. However, when I request, for example, example.com/nothing (non-existent page), PHP-FPM returns a 200 status code, and not the correct 404 status code that NGINX returns. This also happens with other errors (ex: example.com/assets returning 200 with PHP-FPM when the status is 403 with NGINX). Essentially what I want PHP-FPM to do is mirror the status code shown by NGINX (override the 200 status code with the one shown by NGINX), so my error pages show the correct information. I am aware that you can change the status code by specifying it when using http_response_code();, but I would rather have the server do this without having me hard-code the proper status code.

Error page: <? echo http_response_code(); ?>

NGINX error page config:

set $errorDocs "/var/www/GLOBAL_RESOURCES/error";
recursive_error_pages on;
location ^~ $errorDocs {
  internal;
  alias $errorDocs;
}
#Resolve error asset location 404s
location /errorAssets {
  root $errorDocs;
}
error_page 404 /404.php;
location = /404.php {
  root $errorDocs;
  include /etc/nginx/xenon-conf/headers/fpm-params.conf;
}

PHP-FPM settings:

include /etc/nginx/fastcgi_params;
include /etc/nginx/fastcgi.conf;
fastcgi_intercept_errors on;
proxy_intercept_errors on;
try_files $uri =404; 
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass  unix:/var/run/php-fpm/www.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

Fast-CGI Config:

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
#fastcgi_param  REDIRECT_STATUS    200; 

Website Config:

server {
  listen 80;
  server_name example.com www.example.com;
  access_log /var/log/nginx/example.com.access.log;
  include /etc/nginx/xenon-conf/headers/php-fpm-enable.conf;
  include /etc/nginx/xenon-conf/headers/master-failover.conf;

  set $webRoot "/var/www/example.com";
  root $webRoot;
}

NGINX Config:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
  worker_connections 1024;
}

http {
  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

  access_log  /var/log/nginx/access.log  main;

  sendfile            on;
  tcp_nopush          on;
  tcp_nodelay         on;
  keepalive_timeout   65;
  types_hash_max_size 4096;

  include             /etc/nginx/mime.types;
  default_type        application/octet-stream;

  # Load modular configuration files from the /etc/nginx/conf.d directory.
  # See http://nginx.org/en/docs/ngx_core_module.html#include
  # for more information.
  include /etc/nginx/conf.d/*.conf;

  ### CUSTOM HTTP SERVER MASS IMPORTS ###
  include /etc/nginx/xenon-conf/websites/*.web;
  include /etc/nginx/xenon-conf/mapping/*.map;
}

### CUSTOM GENERIC STREAM MASS IMPORTS ###
include /etc/nginx/xenon-conf/stream/*.conf;

Thanks in advance!

Answer 1

If nginx is detecting output from the FastCGI upstream it will consider it as a valid response, even if the upstream (in this case, php-fpm) triggered an error.

Disabling display_errors in the PHP-FPM pool fixes this.

php_admin_value[display_errors] = Off It prevents the PHP-script from showing error output to the screen, which in turn causes nginx to correctly throw an HTTP 500 Internal Server Error.

$  curl -i localhost:8080/test.php?time=`date +%s` HTTP/1.1 500
Internal Server Error Server: nginx ...

(no output is shown, empty response) You can still log all errors to a file, with the error_log directive.

php_admin_value[error_log] = /var/log/php-fpm/error.log
php_admin_flag[log_errors] = on

-- Source

In order to pass HTTP status codes from nginx to PHP-FPM, you also need to put the following in your PHP handling location:

fastcgi_intercept_errors on;

According to the manual, this directive:

Determines whether FastCGI server responses with codes greater than or equal to 300 should be passed to a client or be intercepted and redirected to nginx for processing with the error_page directive.

Answer 2

The main problem here is that by default php-fpm does not return status code to nginx when exception occurs and display_errors is enabled.

TLDR

Use some global error handler that set error status code like this:

http_response_code(500);

This will be passed from php-fpm to nginx and attached to nginx response.

How to test this behaviour

Create index.php file:

<?php
// report all errors
error_reporting(E_ALL);

// do not display errors
ini_set("display_errors", 0);

// set http response code
// http_response_code(500);

// throw exception
throw new \Exception('TEST UNHANDLED EXCEPTION STATUS CODE');

Create default.conf for nginx

server {
    listen       80;
    server_name  localhost;

    location / {
        root   /var/www/html;
        index  index.php index.html index.htm;
    }

    # pass the PHP scripts to FastCGI server listening on php:9000
    location ~ \.php$ {
        root           /var/www/html;
        fastcgi_pass   php:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  /var/www/html/$fastcgi_script_name;
        include        fastcgi_params;
    }
}

Create docker-compose.yml

version: "3.5"

services:
  php:
    image: php:fpm
    volumes:
      - ./index.php:/var/www/html/index.php

  nginx:
    depends_on:
      - php
    image: nginx:latest
    volumes:
      - ./index.php:/var/www/html/index.php
      - ./default.conf:/etc/nginx/conf.d/default.conf

Run project

docker-compose up -d

Install additional tools for testing php-fpm inside php container

To test direct responses from php-fpm wee need to install cgi-fcgi binary

docker-compose exec php bash -c 'apt update && apt install -y libfcgi0ldbl'

Test responses with display_errors disabled

1. Inside php container, make direct request to php-fpm

   SCRIPT_NAME=/var/www/html/index.php SCRIPT_FILENAME=/var/www/html/index.php REQUEST_METHOD=GET cgi-fcgi -bind -connect localhost:9000
   

2. Response contains status code 500 that is handled by nginx correctly:

   Status: 500 Internal Server Error
   X-Powered-By: PHP/8.0.2
   Content-type: text/html; charset=UTF-8
   
   

3. Test response from nginx

   docker-compose exec nginx curl -i localhost
   

   Response:

   HTTP/1.1 500 Internal Server Error
   Server: nginx/1.19.6
   Date: Mon, 22 Feb 2021 11:45:56 GMT
   Content-Type: text/html; charset=UTF-8
   Transfer-Encoding: chunked
   Connection: keep-alive
   X-Powered-By: PHP/8.0.2
   
   
   

php-fpm response contains status code 500 and has no body. Nginx use this code in response.

Test responses with display_errors enabled

1. Let's enable display_errors in index.php:

   // do not display errors
   ini_set("display_errors", 1);
   

2. Inside php container, make direct request to php-fpm

   SCRIPT_NAME=/var/www/html/index.php SCRIPT_FILENAME=/var/www/html/index.php REQUEST_METHOD=GET cgi-fcgi -bind -connect localhost:9000
   

   Response:

   X-Powered-By: PHP/8.0.2
   Content-type: text/html; charset=UTF-8
   
   <br />
   <b>Fatal error</b>:  Uncaught Exception: TEST UNHANDLED EXCEPTION STATUS CODE in /var/www/html/index.php:12
   Stack trace:
   #0 {main}
     thrown in <b>/var/www/html/index.php</b> on line <b>12</b><br />
   

3. Test response from nginx

   docker-compose exec nginx curl -i localhost
   

   Response

   HTTP/1.1 200 OK
   Server: nginx/1.19.6
   Date: Mon, 22 Feb 2021 11:47:29 GMT
   Content-Type: text/html; charset=UTF-8
   Transfer-Encoding: chunked
   Connection: keep-alive
   X-Powered-By: PHP/8.0.2
   
   <br />
   <b>Fatal error</b>:  Uncaught Exception: TEST UNHANDLED EXCEPTION STATUS CODE in /var/www/html/index.php:12
   Stack trace:
   #0 {main}
     thrown in <b>/var/www/html/index.php</b> on line <b>12</b><br />
   
   

php-fpm response is missing status code 500 but has a body. Nginx treats this as normal response with status 200.

Test responses with display_errors enabled and header explicitly set to 500

1. Let's explicitly set response status code with display_errors on.

   // set http response code
   http_response_code(500);
   

2. Test php-fpm response:

   SCRIPT_NAME=/var/www/html/index.php SCRIPT_FILENAME=/var/www/html/index.php REQUEST_METHOD=GET cgi-fcgi -bind -connect localhost:9000
   

   Response:

   Status: 500 Internal Server Error
   X-Powered-By: PHP/8.0.2
   Content-type: text/html; charset=UTF-8
   
   <br />
   <b>Fatal error</b>:  Uncaught Exception: TEST UNHANDLED EXCEPTION STATUS CODE in /var/www/html/index.php:12
   Stack trace:
   #0 {main}
     thrown in <b>/var/www/html/index.php</b> on line <b>12</b><br />
   

3. Test Nginx response

   docker-compose exec nginx curl -i localhost
   

   Response

   HTTP/1.1 500 Internal Server Error
   Server: nginx/1.19.6
   Date: Mon, 22 Feb 2021 11:52:38 GMT
   Content-Type: text/html; charset=UTF-8
   Transfer-Encoding: chunked
   Connection: keep-alive
   X-Powered-By: PHP/8.0.2
   
   <br />
   <b>Fatal error</b>:  Uncaught Exception: TEST UNHANDLED EXCEPTION STATUS CODE in /var/www/html/index.php:12
   Stack trace:
   #0 {main}
     thrown in <b>/var/www/html/index.php</b> on line <b>12</b><br />
   

php-fpm response has status code 500 and body. Nginx uses body and status code from php-fpm.

How to fix

A possible fix I can think of is global error handler that catch every unhandled error and explicitly set proper error status code.