Hotlinking protection in nginx made my domain images disappear

Question

After adding the hotlinking protection code to the server block, none of the images now loads. Here is the complete server block code of the web server in question:

server {
    listen 443 ssl;

    server_name mydomain.com www.mydomain.com 192.168.1.101;

    if ($host !~* ^www\.(.*)$) {
        return 301 https://www.$host$request_uri;
    }

    ssl_certificate             "G:/Web Sites/MyDomain/certificate/certificate.crt";
    ssl_certificate_key         "G:/Web Sites/MyDomain/certificate/private.key";
    ssl_session_cache           shared:SSL:1m;
    ssl_session_timeout         5m;
    ssl_ciphers                 HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers   on;

    charset utf-8;

    access_log logs/MyDomain.log main;

    root   "G:/Web Sites/MyDomain";
    index  index.php index.php3 index.php4 index.php5 index.html index.htm;

    location / {
        location = /favicon.ico {
            log_not_found off;
            access_log off;
        }

        if ($request_uri ~* ".(ico|css|js|gif|jpe?g|png)$") {
            expires 30d;
            access_log off;
            add_header Pragma public;
            add_header Cache-Control "public";
            break;
        }
    }

    error_page 404 /; #404.html;
    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        root html;
    }

    location ~ \.php$ {
        root            "G:/Web Sites/MyDomain";
        fastcgi_pass    127.0.0.1:9000;
        fastcgi_index   index.php;
        fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include         fastcgi_params;
    }

    #Hotlinking protection.
    #location ~* \.(gif|jpe?g|png|wmv|avi|mpg|mpeg|mp4|htm|html|js|css)$ {
    #   valid_referers none blocked mydomain.com *.mydomain.com ~\.google\. ~\.yahoo\. ~\.bing\. ~\.facebook\. ~\.fbcdn\. ~\.twitter\. ~\.pinterest\. ~\.ask\. ~\.wp\.;

    #   if ($invalid_referer) {
    #       return 301 https://sites.google.com/site/tcperpetual/home/hotlinked-message.gif;
    #   }
    #}
}

Not too sure what is wrong or if my images have some other referer, but they are all on my web server. My images are dynamically loaded into a div.

score 0 · Answer 1 · answered Mar 10 '20 at 15:10

Your question has some formatting issues, but here's what I can say. Please also define "not working". You can open the browser's web console (with F12) and see the error code from the network tab.

Nginx will only select a single location block out of the many you have. When your browser requests an image file, Nginx will select the location block you show. If your referrer is valid (depending on the valid_referers directive), your block will do nothing special, otherwise it will return a 403 error.

If you get a 403, check your valid_referers syntax (but it looks correct). If you get a 404, then it probably means you have a location block for / that has all the directives Nginx needs to find the files of your website, but it's not used when requesting an image, probably something like this:

server {
  location / {
    root /var/www;
  }
  location ~* .(gif|...)$ {
    ...
  }
}

Here, when an image is requested, the root directive is not interpreted, so Nginx doesn't know where to look for the file, hence the 404.

Try to put the content of the / location block directly in the server block, so it is actually interpreted, like so:

server {
  root /var/www;
  location ~* .(gif|...)$ {
    ...
  }

Another solution is to copy some of the directives from the / location block if you really need to keep it, like so:

server {
  location / {
    root /var/www;
  }
  location .(gif|...)$ {
    root /var/www;
    ...
  }

Hotlinking protection in nginx made my domain images disappear

1 Answers1