我正在尝试在 nginx 中实现图像热链接保护问题,我需要帮助。我有一个很大的问题,我的网站的图片被提交到 StumbleUpon 等社交网络,带有直接链接,如
http://example.com/xxxxx.jpg
有时会巨大的流量并增加 CPU 使用率和带宽使用率。我想阻止其他引荐来源直接访问我的图片并保护它们不被盗链。
这是我的 vhost.conf 中的代码
server {
access_log off;
error_log logs/vhost-error_log warn;
listen 80;
server_name mydomain.com www.mydomain.com;
# uncomment location below to make nginx serve static files instead of Apache
# NOTE this will cause issues with bandwidth accounting as files wont be logged
location ~* \.(gif|jpg|jpeg|png|wmv|avi|mpg|mpeg|mp4|htm|html|js|css)$ {
root /home/username/public_html;
expires 1d;
}
root /home/mydomain/public_html;
}
location / {
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 4k;
# you can increase proxy_buffers here to suppress "an upstream response
# is buffered to a temporary file" warning
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_connect_timeout 30s;
proxy_redirect http://www.mydomain.com:81 http://www.mydomain.com;
proxy_redirect http://mydomain.com:81 http://mydomain.com;
proxy_pass http://ip_address/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
expires 24h;
}
}
为了保护热链接,我添加了此代码
location ~* (\.jpg|\.png|\.gif|\.jpeg)$ {
valid_referers blocked www.mydomain.com mydomain.com;
if ($invalid_referer) {
return 403;
}
这是该域的当前 nginx 代码,但它不起作用:
server {
access_log off;
error_log logs/vhost-error_log warn;
listen 80;
server_name mydomain.com www.mydomain.com;
# uncomment location below to make nginx serve static files instead of Apache
# NOTE this will cause issues with bandwidth accounting as files wont be logged
location ~* \.(gif|jpg|jpeg|png|wmv|avi|mpg|mpeg|mp4|htm|html|js|css)$ {
root /home/username/public_html;
expires 1d;
}
root /home/mydomain/public_html;
}
location ~* (\.jpg|\.png|\.gif|\.jpeg)$ {
valid_referers blocked www.mydomain.com mydomain.com;
if ($invalid_referer) {
return 403;
}
location / {
client_max_body_size 10m;
client_body_buffer_size 128k;
proxy_send_timeout 90;
proxy_read_timeout 90;
proxy_buffer_size 4k;
# you can increase proxy_buffers here to suppress "an upstream response
# is buffered to a temporary file" warning
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_connect_timeout 30s;
proxy_redirect http://www.mydomain.com:81 http://www.mydomain.com;
proxy_redirect http://mydomain.com:81 http://mydomain.com;
proxy_pass http://ip_address/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
expires 24h;
}
}
我怎样才能解决这个问题?
答案1
您应该在以下网址询问此问题:https://serverfault.com/
我当前的网站使用这个:
## Stop Image and Document Hijacking, alow Google, MSN PicSearch
location ~* \.(png|gif|jpg|jpeg)$ {
set $testref "";
if ($http_referer !~ ^(http://mydomain.com|http://www.google|http://images.search.yahoo|http://www.bing|http://pictures.ask)){
set $testref I;
}
if ($http_user_agent !~* (Googlebot|psbot|msnbot|Yahoo|Ask)) {
set $testref "${testref}G";
}
if ($testref = IG){
return 444;
}
}
您只能使用第一个“if”部分,第二个部分不阻止 Google 和其他图像蜘蛛。第一部分从 mydomain(和 google 等)查找引荐来源,并在其他情况下返回 444。它可以被替换为返回 blank.gif 图像。
答案2
您可以使用valid_referers
Nginx 中的选项来实现这一点。请参阅https://www.atulhost.com/hotlink-protection-nginx
相关代码为:
location ~* \.(gif|jpg|jpeg|png|wmv|avi|mpg|mpeg|mp4|htm|html|js|css)$ {
valid_referers none blocked example.org www.exampleorg ~\.google\. ~\.yahoo\. ~\.bing\. ~\.facebook\. ~\.fbcdn\.;
if ($invalid_referer) {
return 403;
}
root /home/username/public_html;
expires 1d;
}