Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Hotlink protection with nginx?

[digitalpioneer]

Hey, does anyone on this forum know how to do a referral check to prevent hot linking to files that are on a nginx server? There is this regex code you use but I don't know how to put it together. Anyone have a clue how to do it on nginx using their rewrite module?

[zuborg]

location ~ \.(jpg|png|gif)$ {
valid_referers server_names blocked none frienddomain.com *.frienddomain.com ;
if ($invalid_referer) {
return 403;
}
}

[digitalpioneer]

does that allow blank referrals? i'd like it to let blank ones pass

[zuborg]

yes, 'none' keyword allows blank refs

[digitalpioneer]

well it does not work... it is blocking everything and yes i changed frienddomain.com to my site (which it should accept referrals from)

[zuborg]

You don't need to change frienddomain.com to you site - 'server_names' keyword do it for you.
Just skip other domains and leave 'server_names none blocked' keywords.

About 'blocking everything': comment 'return 403;' by '#' - if it will continue blocking - the issue is definitely not in hotlink protection. I can not imagine that config I show will block everithing. Are you sure you are using proper referer in your requests ? How about empty referer ?

[digitalpioneer]

Yeah it still blocks when i comment out return 403. Also, it does not give me 403 errors but 404 errors instead. why is that? and yes i am using a proper referrer

[digitalpioneer]

I am using the debian nginx package (0.5.35-2 lenny) and i have added the code you have given me to /etc/nginx/sites-available/<my_site> in the server { ... } area.

[digitalpioneer]

anyone have a clue?......... =(

[digitalpioneer]

wow out of so many so called sys admins and hosts on here none have a clue. says a lot

[digitalpioneer]

maybe rewrite module is not enabled? hello anyone? how do i enable it?

[zuborg]

Originally Posted by digitalpioneer

Yeah it still blocks when i comment out return 403. Also, it does not give me 403 errors but 404 errors instead. why is that? and yes i am using a proper referrer

404 error means 'Not Found'
Look at error logs.

[funkywizard]

why are you using such an old version of nginx anyway?