Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site with just one file: index.htm which have some ajax linked to php files. I'd like to make those php files only accessible via ajax (post and get) coming from this index file and block access to all files but the index.htm. Is it possible in Nginx? Thanks.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Two thoughts:

In the end, somebody's going to be able to get to them directly by forging headers, but it's a start.

share|improve this answer

Something like this would work:

    location ~ \.php$ {
        if ($http_referer !~* index\.htm) {
            return   403;
        }

        fastcgi_pass 127.0.0.1:9000;
        include fastcgi.conf;

        fastcgi_intercept_errors        on;
        error_page 404 /error/404.php;
    }

Buf keep in mind that it is easy to spoof this header, for e.g.:

$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /pwd.php HTTP/1.0

HTTP/1.1 403 Forbidden
Server: nginx/1.0.5
Date: Thu, 20 Oct 2011 03:06:03 GMT
Content-Type: text/html
Content-Length: 168
Connection: close

$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /pwd.php HTTP/1.0
Referer: index.htm

HTTP/1.1 200 OK
Server: nginx/1.0.5
Date: Thu, 20 Oct 2011 03:06:38 GMT
Content-Type: text/html
Connection: close

/var/www/localhost/htdocs

$ curl localhost:81/pwd.php
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.0.5</center>
</body>
</html>

$ curl --referer index.htm localhost:81/pwd.php
/var/www/localhost/htdocs
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.