nginx hotlink protection not working

Question

So, I'm trying to use this:

location ~ \.(jpe?g|png|gif)$ {
    valid_referers none blocked domain.com *.domain.com;
    if ($invalid_referer) {
    return   403;
}
}

Which supposedly "works", yet everyone online hotlink tester still pulls up the image? Using nginx 1.5.8.

Don't mind me asking, but did you restart nginx? – Ahmad Sherif Jan 28 '14 at 18:59 — Ahmad Sherif, Jan 28 '14 at 18:59
Yup. Every time I tried a new snippet, restarted. – user3245739 Jan 28 '14 at 23:21 — user3245739, Jan 28 '14 at 23:21

score 0 · Answer 1 · answered Apr 11 '14 at 10:34

I had the same problem. I thought it was not working, but actually it was working.

In order to verify it, you have to link your image from other domain. For example, you can add a post on blogspot.com and add an image url from your domain(e.g. http://yourdomain.com/image.jpg) After you published this post, you open it and will see that image does not show. You can see nginx returning 403 in nginx access.log if you did not disable logging.

However, nginx hotlink protection does not work for empty referer. nginx allows all requests with empty referer.

nginx hotlink protection not working

1 Answers1