# Problem with Hotlink Protection **URL:** \ **Category:** NGINX\ **Created:** [September 14, 2011, 5:19pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836 "2011-09-14T17:19:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [September 14, 2011, 5:19pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/1 "2011-09-14T17:19:35Z")
Dear all, I am having a problem getting hotlinking protection to work. I run an image gallery on a nginx webserver and would like to achieve that hotlinking to the images on the website is impossible to save bandwidth. I have the following code in my location block: ← SNIP —\> location ~\* .(png|gif|jpg|jpeg)$ { valid\_referers server\_names; if ($invalid\_referer) { return 403; } } ← SNAP → That works fine so far. But the problem is that the gallery script creates image links that look like this: ← SNIP —\> [http://www.mydomain.com/image.php?twg\_album=album-05900-05999&twg\_show=image-05995.jpg](http://www.mydomain.com/image.php?twg_album=album-05900-05999&twg_show=image-05995.jpg) ← SNAP → These do not trigger the hotlink protection. I am totally lost and have no idea how I might be able to protect those image links from hotlinking. Any help would be highly appreciated! Thank you all in advance! Kind regards -Amitz Posted at Nginx Forum: > **[Problem with Hotlink Protection](https://forum.nginx.org/read.php?2,215198,215198#msg-215198)** > > Dear all, I am having a problem getting hotlinking protection to work. I run an image gallery on a nginx webserver and would like to achieve that hotlinking to the images on the website is impossible to save bandwidth. I have the following code in my... ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 14, 2011, 5:53pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/2 "2011-09-14T17:53:00Z")
On Wed, Sep 14, 2011 at 11:19:05AM -0400, dullnicker wrote: Hi there, > I am having a problem getting hotlinking protection to work. > I have the following code in my location block: > location ~\* .(png|gif|jpg|jpeg)$ { > valid\_referers server\_names; > if ($invalid\_referer) { > return 403; > } > } That applies to locations that end in one of those four words. > > **[MyDomain | Network Solutions](https://www.networksolutions.com/mydomain)** That location ends in “.php”, since things after the ? don’t count for location matching. And so the above config doesn’t apply, as you saw. > These do not trigger the hotlink protection. I am totally lost and have > no idea how I might be able to protect those image links from > hotlinking. The two simplest (to me) ways of approaching it would be (a) if /image.php counts as “an image link”, then configure it like one – wherever in your configuration you match this location, add the “invalid\_referer” check. (If you have something like “location ~\* .php$”, and you don’t want all matching urls to have this configuration, then copy the content to a new “location = /image.php” and add the extra bit there); or (b) if image.php is your modifiable script, and it has access to HTTP\_REFERER, code the protection in there yourself. If neither of those applies, then you can probably try mucking around with $arg\_twg\_show; but that feels wrong to me. All the best, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 14, 2011, 6:23pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/3 "2011-09-14T18:23:18Z")
Dear Francis, thank you very much indeed for taking the time to help me out. It seems that - with your help - I made it! 🙂 I inserted the “invalid\_referrer” check within the “location ~\* .php$” block like you suggested and it works like a charm now! It looks like this: ← SNIP → location ~ .php(.\*)$ { valid\_referers server\_names; if ($invalid\_referer) { return 403; } include fastcgi\_params; fastcgi\_intercept\_errors on; fastcgi\_index index.php; fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name; try\_files $uri =404; fastcgi\_pass 127.0.0.1:9000; error\_page 404 /404page.html; #makes nginx return it’s default 404 # page instead of a blank page } \<–SNAP–\> Again, thank you for your fantastic help! Kind regards -Amitz Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,215198,215207#msg-215207](http://forum.nginx.org/read.php?2,215198,215207#msg-215207) ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 14, 2011, 9:23pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/4 "2011-09-14T21:23:51Z")
On Wed, Sep 14, 2011 at 12:22:30PM -0400, dullnicker wrote: Hi there, > thank you very much indeed for taking the time to help me out. It seems > that - with your help - I made it! 🙂 You’re welcome; and congratulations 🙂 > I inserted the “invalid\_referrer” check within the “location ~\* .php$” > block like you suggested and it works like a charm now! Good stuff. > location ~ .php(.\*)$ { Note that this config applies to all urls that include the four characters “.php”; that certainly includes your /image.php script, but possibly also includes more. If you’re happy that all of those have this invalid\_referer check, then it’s fine. If not, you’ll want to adjust the config again. All the best, ## f Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 14, 2011, 9:57pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/5 "2011-09-14T21:57:17Z")
On 14 Set 2011 17h22 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > valid\_referers server\_names; > error\_page 404 /404page.html; #makes nginx return it’s default 404 > > # page instead of a blank page I think that Francis suggestion is one that you should consider. Restrict the referer checking to the image.php script only. location = /image.php { valid\_referers server\_names; if ($invalid\_referer) { return 403; } include fastcgi\_params; fastcgi\_intercept\_errors on; fastcgi\_index index.php; fastcgi\_param SCRIPT\_FILENAME $document\_root$fastcgi\_script\_name; fastcgi\_pass 127.0.0.1:9000; error\_page 404 /404page.html; # makes nginx return it’s default 404 # page instead of a blank page } HTH, — appa ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 16, 2011, 8:48pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/6 "2011-09-16T20:48:29Z")
Thank you both! I totally agree with you, but as soon as I restrict referer checking to the image.php script only, there is a flaw appearing: image.php then gets downloaded by the browser instead of displaying it. Do you have any idea why this happens? It would be great if I could restrict the check only to this one .php file, but - as said - it does not work here… Thank you again for your kind help and support, Amitz Posted at Nginx Forum: > **[Re: Problem with Hotlink Protection](https://forum.nginx.org/read.php?2,215198,215316#msg-215316)** > > Dear all, I am having a problem getting hotlinking protection to work. I run an image gallery on a nginx webserver and would like to achieve that hotlinking to the images on the website is impossible to save bandwidth. I have the following code in my... ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 18, 2011, 12:50am UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/7 "2011-09-18T00:50:04Z")
On 16 Set 2011 19h47 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Thank you both! I totally agree with you, but as soon as I restrict > referer checking to the image.php script only, there is a flaw > appearing: image.php then gets downloaded by the browser instead of > displaying it. Do you have any idea why this happens? It would be > great if I could restrict the check only to this one .php file, but > > - as said > - it does not work here… No I don’t. If you replicated the FastCGI stuff it should work. The request should be sent upstream to the FastCGI listener that you have on port 9000. Your config had a strange thing. You used a try\_files directive. That doesn’t make sense unless you’re serving the file directly or using another location (try\_files does an internal redirect). My suggestion omitted that. The $fastcgi\_script\_name variable takes as value the $uri. In this case image.php. If you request > **[MyDomain | Network Solutions](https://www.networksolutions.com/mydomain)** this location is used and the request is handled upstream bu the FastCGI process that will use image.php and whatever arguments you give. — appa ---
**Author:** ![dullnicker](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/47e85d/32.png) [@dullnicker](https://www.ruby-forum.com/u/dullnicker)\ **Post date:** [September 16, 2011, 9:54pm UTC](https://www.ruby-forum.com/t/problem-with-hotlink-protection/211836/8 "2011-09-16T21:54:40Z")
Please post the config you are using when it does this.