Forum: NGINX Hotlink Protection Problem

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
jerleung (Guest)
on 2009-06-09 11:59
(Received via mailing list)
I was trying to prevent hotlinking for http://mydomain.com/photos/

then I use the following in nginx.conf

                location ~ /photos/ {
                        valid_referers none blocked server_names;
                        if ($invalid_referer) {
                        return 403;
                  }
                }

I found that it will block hotlinking from other sites and return 403.
However, it will return 404 when the referer is mydomain.com

After testing for quite some time, I found that the following will work

                location ~ /upload/ {
                        root
/home/domainuser/domains/mydomin.com/public_html;
                        valid_referers none blocked server_names;
                        if ($invalid_referer) {
                        return 403;                  }
                }

It only works when I add root to it. Yet, most tutorial does not state
that. Is it a buy on nginx 0.7.59 or I have set something wrong in the
nginx.conf so that I have to add the root?

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,2730,2730#msg-2730
Maxim D. (Guest)
on 2009-06-09 12:30
(Received via mailing list)
Hello!

On Tue, Jun 09, 2009 at 03:49:39AM -0400, jerleung wrote:

>
> I found that it will block hotlinking from other sites and return 403. However, it will 
return 404 when the referer is mydomain.com
>
> After testing for quite some time, I found that the following will work
>
>                 location ~ /upload/ {

Any reason to use "~"?  It does regexp matching instead of prefix
one and shouldn't be used unless required.

>                         root /home/domainuser/domains/mydomin.com/public_html;
>                         valid_referers none blocked server_names;
>                         if ($invalid_referer) {
>                         return 403;                  }
>                 }
>
> It only works when I add root to it. Yet, most tutorial does not state that. Is it a buy 
on nginx 0.7.59 or I have set something wrong in the nginx.conf so that I have to add the 
root?

Normally root is inherited from upper configuration levels.  E.g.
you may specify root once for server{}:

    server {
        server_name  mydomain.com;
        root  /home/domainuser/domains/mydomin.com/public_html;

        location / {
            ...
        }

        location /upload/ {
            valid_referers none blocked server_names;
            if ($invalid_referer) {
                return 403;
            }
        }
    }

Maxim D.
jerleung (Guest)
on 2009-06-09 16:41
(Received via mailing list)
Thanks Maxim. I have made one mistake. I read some tutorial on the web
and I have put root under location /

Really thanks for your reply.

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,2730,2740#msg-2740
This topic is locked and can not be replied to.