# Rewrite module and secure download

**URL:** <https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457>\
**Category:** NGINX\
**Created:** [December 19, 2009, 3:25pm UTC](https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457 "2009-12-19T15:25:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![trinsic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/f05b48/32.png) [@trinsic](https://www.ruby-forum.com/u/trinsic)\
**Post date:** [December 19, 2009, 3:25pm UTC](https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457/1 "2009-12-19T15:25:40Z")

</div>

Hi guys, having a bit of a pickle at the moment. I’ve set up the secure  
download module and its working as it should. The problem is when you  
try to use it, it appends the file name as the hex timestamp (without an  
extension) which is at the end of the URI which isn’t the ideal way of  
downloading things. So I tried using the rewrite module to move the file  
name to the end of the link.

E.g  
/save/dir/6450.png/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa  
(works but downloads as 4b28264c instead of 6450.png)

The way the module works: \< real path \>/\< file \>/\< md5 \>/\< timestamp \>  
The way I want it is: \< real path \>/\< md5 \>/\< timestamp \>/\< file \>

So in comes the rewrite rule. My new links look like:  
/file/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa/dir/6450.png

I have moved the \< md5 \>/\< timestamp \> in front of the \< file \> in hopes  
it would now save the file name properly with its extension. My config  
is below:

location / {  
rewrite /file/(._)/(._)/(._)/(._)$ /save/$3/$4/$1/$2 break;  
}

location /save {  
root /var/www/html/files/12-2009;  
secure\_download on;  
secure\_download\_secret mypass;  
secure\_download\_path\_mode file;  
secure\_download\_fail\_location /error;

```
add_header Content-Disposition attachment;

```

}

As you can see the rewrite rule converts the link back to what it should  
be. That is it moves the \< md5 \>/\< timestamp \> to the end of the URI  
again and changes /file/ back to /save/. Except it now throws a 404  
error. Looking in the debug error log it throws out this:

31949#0: _1 "/file/(._)/(._)/(._)/(.\*)$" matches  
“/file/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa/dir/6450.png”  
31949#0: \*1 rewritten data:  
“/save/dir/6450.png/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa”  
31949#0: \*1 open()  
“/var/www/html/save/dir/6450.png/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa”  
failed (2: No such file or directory)

Pretty much the rewrite rule is converting it exactly as it should be:  
(line 2 of log)  
/save/dir/6450.png/097ac16cb19ff6c163d6f813fdd44b4d/4b283bfa  
(\< real path \>/\< file \>/\< md5 \>/\< timestamp \>)

But where is the secure download module? It hasn’t popped up and done  
its business with the link. Instead line 3 of the log shows it trying to  
open the link when it should do this:

8156#0: \*3 securedownload: evaluated value of secret: “mypass”  
8156#0: \*3 hashing string “/save/dir/6450.png/mypass/4b283bfa” with len  
50  
8156#0: \*3 computed hash: 097ac16cb19ff6c163d6f813fdd44b4d

Its apparent the rewrite module and the secure download module wont work  
together. What can I do to fix this?

I am currently using lighttpd and the modsecdownload module which this  
nginx module is based off, the only real difference is that the lighttpd  
module does all the above already (\< real path \>/\< md5 \>/\< timestamp \>/\<  
file \>) so it saves the file properly.

Hopefully I didn’t miss anything out, any help is much appreciated!

Posted at Nginx Forum:

> **[Rewrite module and secure download](https://forum.nginx.org/read.php?2,30777,30777#msg-30777)**
>
> Hi guys, having a bit of a pickle at the moment. I've set up the secure download module and its working as it should. The problem is when you try to use it, it appends the file name as the hex timestamp (without an extension) which is at the end of...

---

<div class="post-metadata">

**Author:** ![trinsic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/f05b48/32.png) [@trinsic](https://www.ruby-forum.com/u/trinsic)\
**Post date:** [January 14, 2010, 2:29pm UTC](https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457/2 "2010-01-14T14:29:15Z")

</div>

I stumbled upon the exact same problem today while moving our site from  
Lighttpd to nginx.

This is how we solved it:

Link to our protected files look like this:

/pdf/number.pdf/MD5\_hash/hex\_of\_timestamp

and this is our location directive:

```
    # PDF download
    location /pdf {
        secure_download on;
        secure_download_secret $request_addr;
        secure_download_path_mode file;

        if ($uri ~ "^/pdf/(.+\.pdf)$") {
            set $filename $1;
        }
        add_header Content-Disposition "attachment; 

```

filename=$filename";  
}

As you can see from the example we are extracting the filename from the  
request uri and setting the appropriate header.

Posted at Nginx Forum:

> **[Re: Rewrite module and secure download](https://forum.nginx.org/read.php?2,30777,41125#msg-41125)**
>
> Hi guys, having a bit of a pickle at the moment. I've set up the secure download module and its working as it should. The problem is when you try to use it, it appends the file name as the hex timestamp (without an extension) which is at the end of...

---

<div class="post-metadata">

**Author:** ![trinsic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/f05b48/32.png) [@trinsic](https://www.ruby-forum.com/u/trinsic)\
**Post date:** [December 19, 2009, 3:25pm UTC](https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457/3 "2009-12-19T15:25:40Z")

</div>

Hello!

On Tue, Dec 15, 2009 at 11:42:18PM -0500, trinsic wrote:

> Hi guys, having a bit of a pickle at the moment. I’ve set up the secure download module and its working as it should. The problem is when you try to use it, it appends the file name as the hex timestamp (without an extension) which is at the end of the URI which isn’t the ideal way of downloading things. So I tried using the rewrite module to move the file name to the end of the link.

[…]

> But where is the secure download module? It hasn’t popped up and done its business with the link. Instead line 3 of the log shows it trying to open the link when it should do this:
> 
> 8156#0: \*3 securedownload: evaluated value of secret: “mypass”  
> 8156#0: \*3 hashing string “/save/dir/6450.png/mypass/4b283bfa” with len 50  
> 8156#0: \*3 computed hash: 097ac16cb19ff6c163d6f813fdd44b4d
> 
> Its apparent the rewrite module and the secure download module wont work together. What can I do to fix this?

Apparently it’s problem in secure download module. Have you tried  
standart secure link module instead?

> **[GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki...](https://github.com/nginxinc/nginx-wiki)**
>
> ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com

Maxim D.

---

<div class="post-metadata">

**Author:** ![trinsic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/f05b48/32.png) [@trinsic](https://www.ruby-forum.com/u/trinsic)\
**Post date:** [March 31, 2010, 1:44pm UTC](https://www.ruby-forum.com/t/rewrite-module-and-secure-download/180457/4 "2010-03-31T13:44:34Z")

</div>

Interesting post dude…discussion are always helpful in one way or the  
other. Thanks for giving out information. It’s really nice and mean  
full.

Posted at Nginx Forum:

> **[Nginx Forum :: Nginx Mailing List - English](https://forum.nginx.org/read.php?2,30777,69747#msg-69747)**
>
> A portal to and from the mailing list.