FrankenPHP returns 403 for commonly used hidden folders like .well-known/

Open marns93 opened this issue 1 month ago • 1 comments

Steps To Reproduce

The FrankenPHP variant responds with 403 for commonly used URLs like .well-known/.

Example: create a file .well-known/security.txt in the web root.

Outcome

What did you expect?

A request to /.well-known/security.txt returns a 200 and the content.

What happened instead?

The response status code is 403 I think the reason is the filter in here: https://github.com/serversideup/docker-php/blob/9b6868e8facc60b4f17a8898c8eb85c3db10c801/src/variations/frankenphp/etc/frankenphp/Caddyfile#L131

Affected Docker Images

I'm using serversideup/php:8.3-frankenphp

Anything else?

It seems that the same issue was fixed some time ago for NGINX unit, see https://github.com/serversideup/docker-php/issues/469.

Dec 02 '25 14:12 marns93

@jaydrogers Any updates on this?

Dec 08 '25 11:12 marns93