Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

- I have nginx listening on port 80 and serving static files (jpg,css,js, etc)
- if non static files, I proxypass to Apache listening at 8080
- I use "secure_link" to protect my files from being downloaded by unauthorized persons.
- I have an A record in my DNS such as:

sub1 IN A

- is successfully reachable.
- "secure_link" almost works successfully, I can indeed protect my file like this:

- If I replace "ip" to "subdomain", it returns an nginx 403 error :

Extra infos:
- Since everything works fine except the weird subdomain thing, I don't think it is necessary to paste my whole nginx.conf file?

Anyway, here it is:

user www-data;
worker_processes  2;

events {
    worker_connections  1024;

http {

    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    tcp_nopush     on;
    tcp_nodelay on;
    keepalive_timeout  65;

    gzip on;
    gzip_disable "msie6";

    limit_conn_zone $binary_remote_addr zone=slowuser:10m;

    server {

        listen       80;
        server_name  localhost;

        location / {
            #root   /var/www;
            #index  index.html index.htm;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            access_log off;
            add_header Cache-Control public;

        location ~* \.(jpg|jpeg|gif|css|png|js|ico|swf|mp3)$ {
            root   /var/www;
            expires        365d;
            access_log     off;

        location /secretdir/ {
            deny all;
            return 403;
        location /slow/ {
            secure_link $arg_h,$arg_e;
            secure_link_md5 secretkey1$uri$arg_e$remote_addr;

            if ($secure_link = "") {
                return 403;

            if ($secure_link = "0") {
                return 403;
            root   /var/www;
            limit_rate 25k;
            limit_conn slowuser 2;
            rewrite  ^/slow/(.*)$  /secretdir/$1  break;
        location /authorized/ {
            secure_link $arg_h,$arg_e;
            secure_link_md5 secretkey2$uri$arg_e$remote_addr;

            if ($secure_link = "") {
                return 403;

            if ($secure_link = "0") {
                return 403;
            root   /var/www;
            rewrite  ^/authorized/(.*)$  /secretdir/$1  break;

        location = /favicon.ico {
            log_not_found off;
            access_log off;



Please note that:
- is hosted on Server#1, with A name for sub1 declared in it.
- A name redirects on Server#2, which hosts the files to protect.
- The nginx.conf file above is the one on the server#2 ( Server#1 ( is running Apache2 only.
- directories on server#2 are like this:

      |_ download/
      |_ index.html
share|improve this question

server_name localhost;

This is really in your nginx.conf or you faked this for SF? If you want the IP and the domain name to serve requests from the same vhost you should change your config to

listen       80  default_server;
server_name  _;

I suggest to route requests to your IP address to a valid domain name via HTTP 301 (Moved permanently).

I hope this helps.

share|improve this answer
Yes it's my real cfg, I just changed directories name and secretkey. I added extra infos to the first post that might be crucial : and are not on the same server. the nginx.conf here is the one from the server at ( is running Apache2 only). – Musa Jun 18 '13 at 9:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.