# How to disable valid\_referers?

**URL:** <https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910>\
**Category:** NGINX\
**Created:** [November 10, 2010, 2:29pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910 "2010-11-10T14:29:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [November 10, 2010, 2:29pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/1 "2010-11-10T14:29:08Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

Hi guys,

Say if I have many files under / (document root), all of them need  
hotlink protection, except one.

I set valid\_referers for location / as default, how could I skip the  
proection for the specific file?

I guess I can’t simply put “valid\_referers none” here according to the  
documentation at [http://wiki.nginx.org/HttpRefererModule](http://wiki.nginx.org/HttpRefererModule) (It says  
default: none, but I guess this will confuse people with the value  
“none”).

Any help will be greatly appreciated.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG/MacGPG2 v2.0.12 (Darwin)

iEYEARECAAYFAkzandwACgkQdcWH549oblh7+ACfRW1N/So+AEZJQGICi5LzVNMr  
+SQAn2QnsZhCZSSoy4L6o04z9Ih6rgDj  
=2L0L  
-----END PGP SIGNATURE-----

---

<div class="post-metadata">

**Author:** ![Horus\_Lee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/919ad9/32.png) [@Horus\_Lee](https://www.ruby-forum.com/u/Horus_Lee)\
**Post date:** [November 10, 2010, 2:37pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/2 "2010-11-10T14:37:18Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

…never mind, I can set $invalid\_referer to 0 to do this.  
Anyway, thanks, and sorry for the ask-n-answer. 😛

> Hi guys,
> 
> Say if I have many files under / (document root), all of them need  
> hotlink protection, except one.  
> […omitted…]  
> -----BEGIN PGP SIGNATURE-----  
> Version: GnuPG/MacGPG2 v2.0.12 (Darwin)

iEYEARECAAYFAkzan9EACgkQdcWH549oblg88wCgibcBqTLJmivwsD50+nhZwT7r  
KGcAnRXAh8B2DyPNDM50E5pEZ+zqwRtH  
=/aSO  
-----END PGP SIGNATURE-----

---

<div class="post-metadata">

**Author:** ![Horus\_Lee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/919ad9/32.png) [@Horus\_Lee](https://www.ruby-forum.com/u/Horus_Lee)\
**Post date:** [November 10, 2010, 2:37pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/3 "2010-11-10T14:37:19Z")

</div>

On Wed, Nov 10, 2010 at 09:27:58PM +0800, Horus Lee wrote:

> I guess I can’t simply put “valid\_referers none” here according to the  
> documentation at [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/HttpRefererModule) (It says  
> default: none, but I guess this will confuse people with the value “none”).

valid\_referers …;

root …;

location / {  
if ($invalid\_referer) {  
return 403;  
}  
}

location = /some.specfic.file {  
}

location = /other.specfic.file {  
}

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![Horus\_Lee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/919ad9/32.png) [@Horus\_Lee](https://www.ruby-forum.com/u/Horus_Lee)\
**Post date:** [November 10, 2010, 2:44pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/4 "2010-11-10T14:44:51Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

Hi Igor,

> You should not set $invalid\_referer to 0.  
> You should use locations.

Thanks for the help!  
I’ve learned a new lesson… 🙂

-----BEGIN PGP SIGNATURE-----  
Version: GnuPG/MacGPG2 v2.0.12 (Darwin)

iEYEARECAAYFAkzaoYgACgkQdcWH549obljTmgCgpt6LyAXGiMmsyLJzU0foZ5pu  
XN0An2PvWnifA1JQBaj6bDKJHfg+5+xj  
=0mBf  
-----END PGP SIGNATURE-----

---

<div class="post-metadata">

**Author:** ![Horus\_Lee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/919ad9/32.png) [@Horus\_Lee](https://www.ruby-forum.com/u/Horus_Lee)\
**Post date:** [November 10, 2010, 2:39pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/5 "2010-11-10T14:39:12Z")

</div>

On Wed, Nov 10, 2010 at 09:36:20PM +0800, Horus Lee wrote:

> -----BEGIN PGP SIGNED MESSAGE-----  
> Hash: SHA1
> 
> …never mind, I can set $invalid\_referer to 0 to do this.  
> Anyway, thanks, and sorry for the ask-n-answer. 😛

You should not set $invalid\_referer to 0.  
You should use locations.

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![Horus\_Lee](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/919ad9/32.png) [@Horus\_Lee](https://www.ruby-forum.com/u/Horus_Lee)\
**Post date:** [November 10, 2010, 2:46pm UTC](https://www.ruby-forum.com/t/how-to-disable-valid-referers/198910/6 "2010-11-10T14:46:45Z")

</div>

Hello!

On Wed, Nov 10, 2010 at 09:27:58PM +0800, Horus Lee wrote:

> Say if I have many files under / (document root), all of them need  
> hotlink protection, except one.
> 
> I set valid\_referers for location / as default, how could I skip the  
> proection for the specific file?

location / {  
valid\_referers …  
…  
}

location = /some-specific-file {  
# no valid\_referers directive here  
…  
}

See here for details:

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

> I guess I can’t simply put “valid\_referers none” here according to the  
> documentation at [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/HttpRefererModule) (It says  
> default: none, but I guess this will confuse people with the value “none”).

Yes, that’s translation artifact. Changed to “default: no”, that  
should be more clear.

Maxim D.