I have the following situtation:

  1. Service running with secure access (user/pass) through a web application at:


Inside this application (embed/iframe/etc) I configure some services that embeds data from a sub domain.

  1. Subdomain services that should be embed:


These App embed many services in "data.myapp.com" such as "data.myapp.com/sevice1", "data.myapp.com/sevice2", etc...

But the issue is that:

I DO NOT WANT direct access for the "data.myapp.com" subdomain... I want to allow all traffic only if source is from the url https://myapp.com.

Here is how it looks like my nginx conf file:

server {

    server_name myapp.com;

    error_log  /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;

    root /var/www/html;

server {
    server_name data.myapp.com;

    error_log  /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;

    allow myapp.com;
    deny all;

    location /service1/ {...}
    location /service2/ {...}
    location /service3/ {...}

But it seems that I can only use allow with IP address and in that case the server has the same IP address.

Is there a way to block direct access to the current server_name and allow it only from another domain?

Thanks for any help!


I have accomplished in part to block direct access to my data.myapp.com url using referer header... but this is NOT SAFE at all, once we can manipulate the referer header...

Follow the code:

server {


    if ( $http_referer !~* 'myapp.com' ) {
        return 404;

  • 1
    Isn't that what Access-Control-Allow-Origin is for? – Michael Hampton Sep 14 '18 at 13:38
  • Yes I can set Allow Origin, but I need to block direct access to it... the integration of the services is working just fine. I would like to block the direct access to the "services url" not blocking the embeding from my main application. Thanks for you comments @MichaelHampton – Evis Sep 14 '18 at 13:44
  • @MichaelHampton I have update the title to be more specific. – Evis Sep 14 '18 at 13:53
  • How can you know if it is a "direct access"? What does that even mean? – Michael Hampton Sep 14 '18 at 17:52
  • I mean... I want to block access to the url: data.myapp.com from the browser... and allow the myapp.com to embed data from data.myapp.com using iframe.... – Evis Sep 14 '18 at 18:15

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.