Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im using the nginx module HttpSecureLinkModule to protect resources from being hotlinked with expiring hashes which use user's IP address to make a hash that will only work for them, on top of expiring after x seconds. The issue I noticed, is that a very small percentage of users, very frequently, get bad hashes, which results in nginx rejecting the hash and sending the user to an error page that says the hash is expired or malformed.

The servers that generate the hashes and accept them and returns resources are different, times are in sync. People would report issues to me, I would try it myself on multiple PCs, browsers, IPs, and I never had issues.

The only thing that I can think of is that their IP address changes when they hit www.domain.com (which generates the hash) and then hit subdomain.domain.com/file.ext?hash= to get the actual file. Different IP address would cause it to return an error.

Is such a thing possible under certain ISPs? If so, any way to get around it, other than not using IP addresses in the hashes?

share|improve this question
    
what about hashing with a cookie instead of the IP? Also, checking the logs for the IP changes would help to confirm it. –  Eric Fortis May 22 '12 at 19:53
    
I dont think the nginx module supports it. Checking logs is not possible since there is just way too much data to make it work on demand like that. –  user11350 May 22 '12 at 20:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.