MIME Type Filtering§

Now, you can restrict file serving by MIME type:

{
    "share": "/www/data",
    "types": [ "image/*", "video/*" ]
}

The configuration above allows only files with various video and image extensions, but all other requests will return status code 403.

In particular, this goes well with the fallback option that performs another action if the share returns a 40x error:

{
    "share": "/www/data",
    "types": [ "!application/x-httpd-php" ],

    "fallback": {
        "pass": "applications/php"
    }
}

Here, all requests to existing files other than .php will be served as static content while the rest will be passed to a PHP application.

More examples and documentation snippets are available here: https://unit.nginx.org/configuration/#mime-filtering

Chrooting and Path Restrictions When Serving Files§

As we take security seriously, now Unit introduces the ability to chroot not only its application processes but also the static files it serves on a per-request basis. Additionally, you can restrict traversal of mounting points and symbolic link resolution:

{
    "share": "/www/data/static/",
    "chroot": "/www/data/",
    "follow_symlinks": false,
    "traverse_mounts": false
}

See here for more information: https://unit.nginx.org/configuration/#path-restrictions

For details of Unit application process isolation abilities: https://unit.nginx.org/configuration/#process-isolation

Other notable features unrelated to static file serving:

• Multiple WSGI/ASGI Python entry points per process. It allows loading multiple modules or app entry points into a single Python process, choosing between them when handling requests with the full power of Unit’s routes system.

  See here for Python’s targets object description: https://unit.nginx.org/configuration/#configuration-python-targets

  And here, more info about Unit’s internal routing: https://unit.nginx.org/configuration/#routes

• Automatic overloading of http and websocket modules in Node.js. Now you can run Node.js apps on Unit without touching their sources: https://unit.nginx.org/configuration/#node-js

• Applying OpenSSL configuration commands

  Finally, you can control various TLS settings via OpenSSL’s generic configuration interface with all the dynamic power of Unit: https://unit.nginx.org/configuration/#ssl-tls-configuration

The full changelog for the release:

Changes with Unit 1.24.0                                         27 May 2021

    *) Change: PHP added to the default MIME type list.

    *) Feature: arbitrary configuration of TLS connections via OpenSSL
       commands.

    *) Feature: the ability to limit static file serving by MIME types.

    *) Feature: support for chrooting, rejecting symlinks, and rejecting
       mount point traversal on a per-request basis when serving static
       files.

    *) Feature: a loader for automatically overriding the "http" and
       "websocket" modules in Node.js.

    *) Feature: multiple "targets" in Python applications.

    *) Feature: compatibility with Ruby 3.0.

    *) Bugfix: the router process could crash while closing a TLS
       connection.

    *) Bugfix: a segmentation fault might have occurred in the PHP module if
       fastcgi_finish_request() was used with the "auto_globals_jit" option
       enabled.

That’s all for today, but even more exciting features are poised for the upcoming releases:

• statistics API
• process control API
• variables from regexp captures in the match object
• simple request rewrites using variables
• variables support in static file serving options
• ability to override client IP from the X-Forwarded-For header
• TLS sessions cache and tickets

Also, please check our GitHub to follow the development and discuss new features: https://github.com/nginx/unit

Stay tuned!

wbr, Valentin V. Bartenev