Have a node.js project with some pages as static content and some other pages available as dynamic content after user logs into the node project.

NGINX config is like:

root /home/user/myProject/;
index index.html

The problem is that .env , package.json and other folders of the node project – that users aren’t supposed to see – live in the same directory.

If I move web pages to the dedicated folder and change NGINX config to

root /home/user/myProject/views/;
index index.html

nothing is changing.

I tried assigning access rights of node project files to another user (or even root) without any access to other users, whereas the user in NGINX.conf is user – and, guess what, nothing is changing either.

I check it on directory traversal by typing the URL directly

www.myproject.com/.env

and the file still gets downloaded no matter what I do.

Would appreciate you ideas for solving the problem.