I have the following situtation:

  1. Service running with secure access (user/pass) through a web application at:

https://myapp.com

Inside this application (embed/iframe/etc) I configure some services that embeds data from a sub domain.

  1. Subdomain services that should be embed:

https://data.myapp.com

These App embed many services in "data.myapp.com" such as "data.myapp.com/sevice1", "data.myapp.com/sevice2", etc...

But the issue is that:

I DO NOT WANT direct access for the "data.myapp.com" subdomain... I want to allow all traffic only if source is from the url https://myapp.com.

Here is how it looks like my nginx conf file:

server {

    server_name myapp.com;

    error_log  /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;

    root /var/www/html;
}

server {
    server_name data.myapp.com;

    error_log  /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;

    allow myapp.com;
    deny all;

    location /service1/ {...}
    location /service2/ {...}
    location /service3/ {...}
}

But it seems that I can only use allow with IP address and in that case the server has the same IP address.

Is there a way to block direct access to the current server_name and allow it only from another domain?

Thanks for any help!


UPDATE

I have accomplished in part to block direct access to my data.myapp.com url using referer header... but this is NOT SAFE at all, once we can manipulate the referer header...

Follow the code:

server {

    [...]

    if ( $http_referer !~* 'myapp.com' ) {
        return 404;
    }

    [...]
}
  • 1
    Isn't that what Access-Control-Allow-Origin is for? – Michael Hampton Sep 14 at 13:38
  • Yes I can set Allow Origin, but I need to block direct access to it... the integration of the services is working just fine. I would like to block the direct access to the "services url" not blocking the embeding from my main application. Thanks for you comments @MichaelHampton – Evis Sep 14 at 13:44
  • @MichaelHampton I have update the title to be more specific. – Evis Sep 14 at 13:53
  • How can you know if it is a "direct access"? What does that even mean? – Michael Hampton Sep 14 at 17:52
  • I mean... I want to block access to the url: data.myapp.com from the browser... and allow the myapp.com to embed data from data.myapp.com using iframe.... – Evis Sep 14 at 18:15

Possibly, you need to add

listen      80 default_server;

directive to you server section, eg

server {
  listen      80 default_server;
  server_name myapp.com;

  error_log  /var/log/nginx/error.log;
  access_log /var/log/nginx/access.log;

  root /var/www/html;
}

See documentation

  • Thanks for you message... but that does not respond my question... – Evis Sep 14 at 14:36

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.