# Problem with Direct-Linking-Prevention

**URL:** <https://www.ruby-forum.com/t/problem-with-direct-linking-prevention/211005>\
**Category:** NGINX\
**Created:** [August 23, 2011, 11:01am UTC](https://www.ruby-forum.com/t/problem-with-direct-linking-prevention/211005 "2011-08-23T11:01:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [August 23, 2011, 11:01am UTC](https://www.ruby-forum.com/t/problem-with-direct-linking-prevention/211005/1 "2011-08-23T11:01:27Z")

</div>

Hello!

Yesterday I’ve switched from Apache2 to Nginx - and ran into some  
problems with the rewrite Rules.

I tried to do something like:

SetEnvIf Referer mydomain.com localreferer  
\<FilesMatch .(rar|zip)$\>  
Order deny,allow  
Deny from all  
Allow from env=localreferer

(Which worked on Apache.)

And I came up with this:

```
     ## Stop Download Hijacking
     location ~* (\.rar|\.zip)$ {
             if ($http_referer !~

```

^([http://www.mydomain.com|http](http://www.mydomain.com%7Chttp)://mydomain.com) ) {  
return 444;  
}  
}

Whole config for this server is:

server {  
root /home/mydomain/files;  
index index.php index.html;  
server\_name [download.mydomain.com](http://download.mydomain.com);

```
     ## Stop Download Hijacking
     location ~* (\.rar|\.zip)$ {
             if ($http_referer !~

```

^([http://www.mydomain.com|http](http://www.mydomain.com%7Chttp)://mydomain.com) ) {  
return 444;  
}  
}  
location / {  
try\_files $uri $uri/ /index.php;  
}

```
     include /etc/nginx/php;

```

}

Problem is - it seems to do nothing at all … I can type a download  
link into my browser and it loads (should block that unless it was  
refered from mydomain).

Has anyone any ideas?

Thanks in advance!  
Alexander

---

<div class="post-metadata">

**Author:** ![Tamashii](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b9e5f3/32.png) [@Tamashii](https://www.ruby-forum.com/u/Tamashii)\
**Post date:** [August 24, 2011, 3:29pm UTC](https://www.ruby-forum.com/t/problem-with-direct-linking-prevention/211005/2 "2011-08-24T15:29:12Z")

</div>

I’m wondering why don’t you try [http://wiki.nginx.org/HttpRefererModule](http://wiki.nginx.org/HttpRefererModule)?

Posted at Nginx Forum:

> **[Re: Problem with Direct-Linking-Prevention](https://forum.nginx.org/read.php?2,214166,214255#msg-214255)**
>
> Hello! Yesterday I've switched from Apache2 to Nginx - and ran into some problems with the rewrite Rules. I tried to do something like: SetEnvIf Referer mydomain\\.com localreferer \<FilesMatch \\.(rar|zip)$\> Order deny,allow

---

<div class="post-metadata">

**Author:** ![Tamashii](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b9e5f3/32.png) [@Tamashii](https://www.ruby-forum.com/u/Tamashii)\
**Post date:** [August 24, 2011, 8:30pm UTC](https://www.ruby-forum.com/t/problem-with-direct-linking-prevention/211005/3 "2011-08-24T20:30:11Z")

</div>

On 23 Ago 2011 10h00 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Deny from all  
> ^([http://www.mydomain.com|http](http://www.mydomain.com%7Chttp)://mydomain.com) ) {  
> return 444;  
> }  
> }

Cf. [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/NginxHttpRefererModule)

Try:

## No download hijacking.

location ~\* .(?:rar|zip)$ {

```
valid_referers none blocked www.mydomain.com mydomain.com {
    if ($invalid_referer) {
      return 444;
    }
}

```

}

— appa