Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Im using the nginx module HttpSecureLinkModule to protect resources from being hotlinked with expiring hashes which use user's IP address to make a hash that will only work for them, on top of expiring after x seconds. The issue I noticed, is that a very small percentage of users, very frequently, get bad hashes, which results in nginx rejecting the hash and sending the user to an error page that says the hash is expired or malformed.

The servers that generate the hashes and accept them and returns resources are different, times are in sync. People would report issues to me, I would try it myself on multiple PCs, browsers, IPs, and I never had issues.

The only thing that I can think of is that their IP address changes when they hit (which generates the hash) and then hit to get the actual file. Different IP address would cause it to return an error.

Is such a thing possible under certain ISPs? If so, any way to get around it, other than not using IP addresses in the hashes?

share|improve this question
what about hashing with a cookie instead of the IP? Also, checking the logs for the IP changes would help to confirm it. – Eric Fortis May 22 '12 at 19:53
I dont think the nginx module supports it. Checking logs is not possible since there is just way too much data to make it work on demand like that. – user11350 May 22 '12 at 20:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.