Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to use nginx to proxy CDN use for our site to prevent raw video access when people put the CDN URL into their browser, and instead redirect them to a video page. If it's not a cacheable object, just pass the connection back to our main site.

Here's my initial config:

server {
    listen *:80;

    # cachable objects, no restrictions
    location ~ (^/img|^/css|^/js|^/video/thumbnail|^/user/avatar) {
        proxy_pass       http://cdn$request_uri;
        proxy_set_header Host "";

    # raw video requests
    location ~ ^/video/raw {
        rewrite_log    on;
        valid_referers *;

        # get the video id from the end of the string
        if ($uri ~* ^/video/raw/(.*)$) {
            set $vidid $1;

        # The app is automatically passed
        if ($http_user_agent ~* Example) {
            proxy_pass http://cdn$request_uri;

        # redirect requests for raw video to page for that video
        if ($invalid_referer) {
            rewrite ^(.*)$ /!$vidid break;

        proxy_pass       http://mainsite$request_uri;
        proxy_set_header Host "";

    # everything else goes to origin, no caching
    location / {
        proxy_pass       http://mainsite$request_uri;
        proxy_set_header Host "";

It correctly proxies, but when I request the raw video without the Example user-agent and no referer, I still get the raw video.

Any tips?

share|improve this question
You're putting a single nginx server in front of a CDN?? – mgorven Feb 1 '13 at 19:14
Yes, for a single, small country. – Jeremy Wilson Feb 1 '13 at 22:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.