Nginx redirects .well-known endpoints - nginx

Question

I have a web application that runs on WSGI server. The application has OpenID Connect identity provider endpoints, for instance:
/oidc/.well-known/openid-configuration
/oidc/.well-known/simple-web-discovery
/oidc/.well-known/webfinger
Requests to these endpoints are mapped to some functions in my project, which run necessary tasks for each endpoint. I can run my application, and all requests are successfully mapped and handled by the defined functions.
The challenge starts when I host my application on a public IP behind https. For this I use nginx to proxy access to my application. nginx makes my application accessible over a public IP over https. Here is key sections of my nginx config file:
server {
listen 80;
listen [::]:80 default_server;
server_name localhost;
root /home/user/myApp;
include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://my_app;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-URL-SCHEME https;
}
}
server {
listen 443 ssl;
server_name localhost;
root /home/user/myApp;
ssl_certificate /home/user/cacert.pem;
ssl_certificate_key /home/user/privkey.pem;
include /etc/nginx/default.d/*.conf;
location ~ /\.well-known { allow all; }
location / {
proxy_pass http://my_app;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-URL-SCHEME https;
}
}
Every call is requested/posted correctly, except for the requests to /.well-known/* (actually location ~ /\.well-known { allow all; } in the config is an attempt to solve it), for which I get either 404 or 403 errors.
For instance, one error message in nginx error log reads:
open() "/home/user/myApp/oidc/.well-known/openid-configuration" failed (13: Permission denied), client: X.X.X.X, server: localhost, request: "GET /oidc/.well-known/openid-configuration HTTP/1.1", host: "X.X.X.X"
(IP addresses are masked out)
Few points:
I'm running my application with sudo privileges, so the application has r/w access to all the paths.
Actually, the path /home/user/myApp/oidc/.well-known/openid-configuration does not exist (and thats why I also get 404 error).
/oidc/.well-known/openid-configuration should be mapped to a function (as it happens when I host my application without nginx). So, I don't understand why nginx tries to access a non-existing /oidc/.well-known/* path/file ?!

Answer 1

The problem is the setting location ~ /\.well-known { allow all; }.
This should be removed. Additionally, the setting include /etc/nginx/default.d/*.conf; includes a default config file which also has the setting location ~ /\.well-known { allow all; }. This setting should be removed from that file too.