2

I am trying to implement image hotlink protection problem in nginx and I need help. I have a huge issue of my site's images being submitted to social networks like StumbleUpon with a direct link like

http://example.com/da.jpg

now i want to block access to them but I cannot implement hotlink prevention in my nginx.conf file. Below is my nginx.conf file where should I place the code?

Hotlink code to be implemented:

  location ~ \.(jpe?g|png|gif)$ {
    valid_referers none blocked example.com *.example.com;
    if ($invalid_referer) {
        return 403;
    }
}  

My current code is below

{

#user  nobody;
worker_processes  10;
worker_rlimit_nofile 81918;
#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  81918;
    multi_accept on;
}


http {


    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 8m;
    large_client_header_buffers 2 1k;

    client_body_timeout   32;
    client_header_timeout 32;
    sendfile_max_chunk 512k;
    keepalive_timeout 5; # default 65
    send_timeout 20;     # default 60

    reset_timedout_connection on;

    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  5;
    #keepalive_timeout  65;

    #gzip  on;

    server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   html;
            index  index.html index.htm;
        }


        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    server {
        listen       *:80;
            server_name  dl.rahim-soft.org;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;
        location / {
            root   E:/WWW;
            index  index.html index.htm;

        }
    }
    server {
        listen       *:80;
        server_name  dl1.rahim-soft.org;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   E:/dl1;
            index  index.html index.htm;
        }
    }
    server {
        listen       *:80;
        server_name  dl2.rahim-soft.org;

        #charset koi8-r;

        #access_log  logs/host.access.log  main;

        location / {
            root   F:/dl2.rahim-soft.org;
            index  index.html index.htm;
        }

    }

}
3

Perhaps your images need a root location too.

server {
  listen       *:80;
  server_name  dl2.rahim-soft.org;

  location / {
    location ~* \.(jpe?g|png|gif)$ {
      valid_referers none blocked rahim-soft.org *.rahim-soft.org;
      if ($invalid_referer) {
        return 403;
      }
    }  

    root   F:/dl2.rahim-soft.org;
    index  index.html index.htm;
  }
} 
1

You need to cut & paste that snippet of config inside every server { } stanza, e.g. for dl2.rahim-soft.org:

server {
    listen       *:80;
    server_name  dl2.rahim-soft.org;

    location ~ \.(jpe?g|png|gif)$ {
        root   F:/dl2.rahim-soft.org;
        valid_referers none blocked rahim-soft.org *.rahim-soft.org;
        if ($invalid_referer) {
            return 403;
        }
    }  
    location / {
        root   F:/dl2.rahim-soft.org;
        index  index.html index.htm;
    }
} 

Nginx will serve regular expression matches in preference to prefix matches. However, it evaluates prefix locations first, allowing for the admin to override this by specifying locations using the = and ^~ modifiers.

While prefix locations generally select based on the longest, most specific match, regular expression evaluation is stopped when the first matching location is found.

To better understand how nginx prioritizes location matching, you might want to read this excellent article by digitalocean:

https://www.digitalocean.com/community/tutorials/understanding-nginx-server-and-location-block-selection-algorithms#matching-location-blocks

2
  • i cut and replaced it but still not working i am using nginx on windows server 2016 – Abdulrahim safi Apr 16 '18 at 11:47
  • I assume you replaced example.com *.example.com with the accepted referral domains? Updated answer just for clarity. – Luca Gibelli Apr 16 '18 at 13:16
-1

I think you forgot a part of the syntax (server_names):

    valid_referers none blocked server_names example.com *.example.com;
9
  • when i added now i get 404 not found – Abdulrahim safi Apr 16 '18 at 12:48
  • but not because of "valid_referers". Enable your error and access logs, and you will see. – Gerard H. Pille Apr 16 '18 at 12:52
  • i came to it from valid referer which (example.com ) but still i get 404 not 403 – Abdulrahim safi Apr 16 '18 at 12:55
  • So, example.com may use your images, but if they request an image that does not exist, or nginx is not allowed to read, you get 404. That's life. Check your logs. – Gerard H. Pille Apr 16 '18 at 12:57
  • no my files are allowed when i remove the code for hotlinking i can access the images but when add code i get 404 – Abdulrahim safi Apr 16 '18 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.