perusio/drupal-with-nginx — Issue #34: Disable image hotlinking
Author: Fleshgrinder
Created: 2012-03-08 14:15:18+00:00
State: open

Hi perusio!

Just implemented this in my own website and thought you might be interested to include this as an optional (or standard) part of your nginx configuration. I'm posting this here, because I'm using Drupal, of course this works with any of your nginx configurations.

```bash
### This file implements a blacklist for certain referrers. It's
### used to prevent hotlinking of your images. Must be included
### in server context.

## Stop image hotlinking!
location / {
## Add here all valid referrers, use the RegEx pattern
## ~(mydomain.com) do include all possible subdomains and the
## pattern ~(mydomain.) to include all possible subdomains
## TLDs as well. You can separate many hosts with a pipe.
## ~(mydomain.com|google.|bing.|yahoo.)
##
## More info at:
## http://www.cyberciti.biz/tips/linux-unix-bsd-nginx-webserver-security.html
## http://linuxsysadminblog.com/2009/08/using-wildcards-in-nginx-valid_referers/
valid_referers none blocked server_names ~(mydomain.com|google.|bing.|yahoo.);

## It's wise to redirect to an image hosting service, so your
## bandwith won't be used to serve this picture.
if ($invalid_referer) {
return 444;
#return 403;
#rewrite ^/.*\.(gif|jpg|jpeg|png)$ http://myimagehoster.com/hotlinking.jpg last;
}
}
```
By default I allow no referrers (valid users might not submit one), blocked (if users try to to stay anonymous) our server names, our domain including all subdomains and of course the big search engines including all subdomains and TLDs.

Hope you like it and keep up the great work!

Regards
Richard