# Problem using X-Accel-Redirect in nginx under ssl

**URL:** <https://www.ruby-forum.com/t/problem-using-x-accel-redirect-in-nginx-under-ssl/111559>\
**Category:** Deployment\
**Created:** [August 8, 2007, 4:08pm UTC](https://www.ruby-forum.com/t/problem-using-x-accel-redirect-in-nginx-under-ssl/111559 "2007-08-08T16:08:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nadav](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/8e7dd6/32.png) [@nadav](https://www.ruby-forum.com/u/nadav)\
**Post date:** [August 8, 2007, 4:08pm UTC](https://www.ruby-forum.com/t/problem-using-x-accel-redirect-in-nginx-under-ssl/111559/1 "2007-08-08T16:08:22Z")

</div>

Hi everybody.

I have a problem using X-Accel-Redirect under ssl in nginx for serving  
static image-files that I want to protect from unauthorized downloads.  
The problem is that the images downloading is extremely slow, and a  
timeout occurs before the  
whole image is being downloaded to the browser.

I read that the way protect certain static files (like images) from  
being  
exposed to the public (so for example, only logged-in users will be  
permitted to download  
the images) in nginx is to use X-Accel-Redirect response header in  
combination  
with ‘internal’ location configuration. ([http://wiki.codemongers.com/](http://wiki.codemongers.com/)  
NginxXSendfile)

I want urls like [https://mydomain.com/item-images/some\_image.jpg](https://mydomain.com/item-images/some_image.jpg)  
to be mapped to the ImagesController#download\_image action in which  
the user authorization  
to download the file will be checked.

That’s what I did:

###In config/routes.rb  
ActionController::Routing::Routes.draw do |map|  
map.connect ‘item\_images/:image\_path’,  
:controller =\> ‘images’,  
:action =\> ‘download\_image’,  
:image\_path =\> /.+/  
.  
.  
.  
end

### In app/controllers/images\_controller.rb

class ImagesController \< ApplicationController

def download\_image

```
# Some checking in here - suppose the user is authorized to

```

download the file  
# I want nginx to serve the file.

```
# I know - params[:image_path] should be sanitized...
response.headers["X-Accel-Redirect"] = "/item-images/

```

#{params[:image\_path]}"  
render :nothing =\> true  
end

end

### In nginx.conf

server {  
# port to listen on. Can also be set to an IP:PORT  
listen 443;

```
ssl on;
ssl_certificate /path-to/ssl.crt/ssl_cert.crt;
ssl_certificate_key /path-to/ssl.key/ssl_cert_key.key;

ssl_session_timeout 5m;

keepalive_timeout 70;

# Set the max size for file uploads to 50Mb
client_max_body_size 150M;

# sets the domain[s] that this vhost server requests for
server_name mydomain.com anotherdomain.com;

# doc root
root html;

# vhost specific access log
access_log /usr/local/nginx/logs/nginx.vhost.access.log main;

# this rewrites all the requests to the maintenance.html
# page if it exists in the doc root. This is for capistrano's
# disable web task
if (-f $document_root/system/maintenance.html) {
  rewrite ^(.*)$ /system/maintenance.html last;
  break;
}

```

#### THIS IS THE INTERNAL LOCATION REFERED TO BY X-Accel-Redirect

location /item-images/ {  
# The protected images directory is /var/www/rails/item-images  
root /var/www/rails/;  
internal;  
}

### 

location / {  
.  
.  
.  
# Proxing to mongrel the ‘usuall’ way ([http://brainspl.at/articles/](http://brainspl.at/articles/)  
2007/01/03/new-nginx-conf-with-optimizations)  
}  
}

As mentioned this works So slowly, that a timeout occurs.  
However if I do not use ssl, or if I just put the images under public  
directory  
it seems to be ok (also under ssl).

I use rhel4 + nginx 0.5.30 .

Thanks for your kind help

Nadav

---

<div class="post-metadata">

**Author:** ![nadav](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/8e7dd6/32.png) [@nadav](https://www.ruby-forum.com/u/nadav)\
**Post date:** [August 9, 2007, 7:34am UTC](https://www.ruby-forum.com/t/problem-using-x-accel-redirect-in-nginx-under-ssl/111559/2 "2007-08-09T07:34:06Z")

</div>

Hi everybody.  
I wote my question again, with better line-breaks…

I have a problem using X-Accel-Redirect under ssl in nginx for  
serving  
static image-files that I want to protect from unauthorized  
downloads.  
The problem is that the images downloading is extremely slow, and a  
timeout occurs before the whole image is being downloaded to the  
browser.

I read that the way protect certain static files  
(like images) from being exposed to the public  
(so for example, only logged-in users will be permitted to download  
the images) in nginx is to use X-Accel-Redirect response header in  
combination with ‘internal’ location configuration.  
([http://wiki.codemongers.com/NginxXSendfile](http://wiki.codemongers.com/NginxXSendfile))

I want urls like [https://mydomain.com/item\_images/some\_image.jpg](https://mydomain.com/item_images/some_image.jpg)  
to be mapped to the ImagesController#download\_image action in which  
the user authorization to download the file will be checked.

That’s what I did:

###In config/routes.rb  
ActionController::Routing::Routes.draw do |map|  
map.connect ‘item\_images/:image\_path’,  
:controller =\> ‘images’,  
:action =\> ‘download\_image’,  
:image\_path =\> /.+/  
.  
.  
.  
end

### In app/controllers/images\_controller.rb

class ImagesController \< ApplicationController

def download\_image

```
# Some checking in here - suppose the user is
# authorized to download the file
# I want nginx to serve the file.

# I know - params[:image_path] should be sanitized...
response.headers["X-Accel-Redirect"] = "/item-images/

```

#{params[:image\_path]}"  
render :nothing =\> true  
end

end

### In nginx.conf

server {  
# port to listen on. Can also be set to an IP:PORT  
listen 443;

```
ssl on;
ssl_certificate /path-to/ssl.crt/ssl_cert.crt;
ssl_certificate_key /path-to/ssl.key/ssl_cert_key.key;

ssl_session_timeout 5m;

keepalive_timeout 70;

# Set the max size for file uploads to 50Mb
client_max_body_size 150M;

# sets the domain[s] that this vhost server requests for
server_name mydomain.com anotherdomain.com;

# doc root
root html;

# vhost specific access log
access_log /usr/local/nginx/logs/nginx.vhost.access.log main;

# this rewrites all the requests to the maintenance.html
# page if it exists in the doc root. This is for capistrano's
# disable web task
if (-f $document_root/system/maintenance.html) {
  rewrite ^(.*)$ /system/maintenance.html last;
  break;
}

```

#### THIS IS THE INTERNAL LOCATION REFERED TO BY X-Accel-Redirect

location /item-images/ {  
# The protected images directory is /var/www/rails/item-images  
root /var/www/rails/;  
internal;  
}

### 

location / {  
.  
.  
.  
# Proxing to mongrel the ‘usuall’ way  
# ([http://brainspl.at/articles/2007/01/03/new-nginx-conf-with-](http://brainspl.at/articles/2007/01/03/new-nginx-conf-with-)  
optimizations)  
}

}

As mentioned this works So slowly, that a timeout occurs.  
However if I do not use ssl, or if I just put the images under public  
directory  
it seems to be ok (also under ssl).

I use rhel4 + nginx 0.5.30 .

Thanks for your kind help

Nadav