nginx.conf

location /storage {
    alias /var/www/html/storage;
    index index.xml;

    # Set custom error pages for 404 and 403
    error_page 404 /storage/404.xml;
    error_page 403 /storage/403.xml;

    # Allow serving only whitelisted file extensions
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|docx|doc|pdf|ppt|pptx)$ {
        try_files $uri =404;
    }

    # Limit maximum file size for uploads
    client_max_body_size 10M; # Change the value as needed

    # Whitelist allowed file extensions for uploads
    if ($request_filename ~* ^.*?\.(exe|php|py|pl|cgi|bin|sh|bat|dll|asp|aspx|jsp|html|htm|shtml|phtml|php3|php4|php5|php6|php7)$) {
        return 403;
    }

    # Block PHP execution
    location ~ \.php$ {
        deny all;
    }

    # Additional security measures can be added here
}