Hotlink Protection in Nginx working too well in Firefox

I use hotlink protection in Nginx and it is working very well!

For some reason - and the reason for this question - it is not allowing visitors to my site using firefox to see any images, which they should. For IE, Chrome, Safari, and Opera, it works just fine. Images show up on my site but not if you try to hotlink.

I checked Firefox on Win and on Mac and it happens in both places. Headers send the same referres (as far as I can see) as does IE and the others.

The hotlink protection code looks like so

location ~ \.(jpg|jpeg|png|gif|swf)$ {
    valid_referers server_names blocked *.mysite.com;
    if ($invalid_referer) {
        rewrite ^(.*)$ /nopeeking.png break;
    }
}

location =/nopeeking.png {
    root /path/to/my/site;
}   

As I said, this is working very well! Anyone trying to hotlink gets the nopeeking.png image in their face. Fine.

If it wasn't for Firefox.

Any ideas as to why this works in all browsers but not in FF which treats it like it is trying to peek?

5 Replies

I had an issue similar to this, for some reason some firefox browsers do not send a referrer header, add "none" to your valid_referers

I'll try that as soon as the traffic is a bit easier than now.

I don't know a good way to refresh this setting in Nginx other than restarting it and I don't really want to do that now.

But thanks much. Your answer makes sense and it's probably what's gone wrong here. Thanks.

run service nginx reload that will reload the nginx configuration without restarting the server.

Superb!

Works very well.

Thanks for the tip on how to reload the nginx config, I guess I could've (or rather should have) found it on the nginx wiki.

Thanks just the same.

I have used this:

location ~ .(jpg|jpeg|png|gif|swf)$ {

validreferers servernames blocked *.mydomain.com;

if ($invalid_referer) {

return 403;

}

but I find that the images with

https://

addresses are not showing. Since I have SSL enabled on my website most of the images are not showing…

What should I do?

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct