Skip to content

Conversation

@marns93
Copy link

@marns93 marns93 commented Dec 16, 2025

Fixes: #626

The newest variation frankenphp is blocking everything under .well-known/. The following line is responsible for this

@rejected path *.bak *.conf *.dist *.fla *.ini *.inc *.inci *.log *.orig *.psd *.sh *.sql *.swo *.swp *.swop */.*

In this PR I've whitelisted some commonly used paths under .well-known/. For security reasons I don't want to allow everything, so I've whitelisted some of them. The list can be extended in the future.

@jaydrogers
Copy link
Member

Thanks for the PR! I will review soon 👍

@wapacro
Copy link

wapacro commented Jan 6, 2026

Great PR, running into this issue right now. However, I'd add some more common endpoints for web apps, at least .well-known/passkey-endpoints and .well-known/webauthn (for proper Passkey support) if not all of them.

@marns93 marns93 force-pushed the fix-blocking-well-known-path branch from d7aed51 to 00df1ca Compare January 9, 2026 12:54
@marns93
Copy link
Author

marns93 commented Jan 9, 2026

Great PR, running into this issue right now. However, I'd add some more common endpoints for web apps, at least .well-known/passkey-endpoints and .well-known/webauthn (for proper Passkey support) if not all of them.

@wapacro Thank you for your feedback. I've added your endpoints in this PR.
In general I do agree, but I would make the whitelist explicitly based on requests.

@marns93
Copy link
Author

marns93 commented Jan 9, 2026

@jaydrogers Any estimation when this can be reviewed and merged on your side?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

FrankenPHP returns 403 for commonly used hidden folders like .well-known/

3 participants