Welcome! Log In Create A New Profile

Advanced

Re: Prevent direct access to files but allow download from site

March 12, 2020 06:03PM
The key requirement you mentioned now: the user needs to be logged in.

So, the next question is: how do we know the user is logged in. It can't be just a simple cookie because that could be faked (I could add "LOGGED_IN=1" without the site authorizing this), and therefore there is no security at all. Maybe added obscurity :-)

What you need to do is issue a cookie that can only have been created by NGINX, e.g., something like a string "{user}/{checksum}", where {user} is the id of the logged-in user, and {checksum} is an HMAC of a secret only known to NGINX and that user id. In consequence, without knowing the secret, nobody can fake this cookie. If NGINX gets the cookie, it can determine the HMAC of the user id and compare against the checksum provided, in order to check the validity of the request.

The HMAC computation and validation can quickly be done with a few lines of Javascript, and would even allow for some sort of single sign-on across all services capable of using these functions (also in other NGINX instances knowing this secret). Maybe you want to add some form of expiration to such cookies.

The classical way, however, is to use https and something like a basic authentication (auth_basic directive), and require valid authentication for those URIs referring to protected files. If your authentication scheme is a bit more complex, you may want to use auth_request or some form of initial login plus a secured session cookie as described above. Essentially, this principle (with JWT) is also used by more novel schemes such as OpenID Connect.

Let's see if this helps you further.
Subject Author Posted

Prevent direct access to files but allow download from site

MAXMAXarena March 11, 2020 06:36PM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 11, 2020 06:58PM

Re: Prevent direct access to files but allow download from site

gariac March 11, 2020 08:46PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 11, 2020 09:23PM

Re: Prevent direct access to files but allow download from site

gariac March 11, 2020 10:20PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 05:49AM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 11, 2020 10:22PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 05:47AM

Re: Prevent direct access to files but allow download from site

j94305 March 11, 2020 10:36PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 07:42AM

Re: Prevent direct access to files but allow download from site

j94305 March 12, 2020 06:03PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 13, 2020 09:20AM

Re: Prevent direct access to files but allow download from site

lsces April 05, 2020 11:42AM

Re: Prevent direct access to files but allow download from site

J.R. March 12, 2020 12:02PM

Re: Prevent direct access to files but allow download from site

MAXMAXarena March 12, 2020 01:12PM

RE: Prevent direct access to files but allow download from site

Reinis Rozitis March 12, 2020 06:32PM

Re: Prevent direct access to files but allow download from site

Ralph Seichter March 12, 2020 08:18PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 68
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready