Serving protected files using Nginx's X-Accel-Redirect header

Question

I'm trying to serve protected files using this directive in my nginx.conf:

 location /secure/ { internal; alias /home/ldr/webapps/nginx/app/secure/; } 

I'm passing in paths in the form: "/myfile.doc"

and the file's path would be: /home/ldr/webapps/nginx/app/secure/myfile.doc

I just get 404's when I access "http: //myserver/secure/myfile.doc" (space inserted after http to stop ServerFault converting it to a link)

I've tried taking the trailing / off the location directive and that makes no difference.

Two questions:

1. How do I fix it!
2. How can I debug problems like this myself? How can I get Nginx to report which path it's looking for? error.log shows nothing and access.log just tells me which url is being requested - this is the bit I already know! It's no fun trying things randomly without any feedback.

Here's my entire nginx.conf:

 daemon off; worker_processes 2; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; server { listen 21534; server_name my.server.com; client_max_body_size 5m; location /media/ { alias /home/ldr/webapps/nginx/app/media/; } location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; fastcgi_pass unix:/home/ldr/webapps/nginx/app/myproject/django.sock; fastcgi_pass_header Authorization; fastcgi_hide_header X-Accel-Redirect; fastcgi_hide_header X-Sendfile; fastcgi_intercept_errors off; include fastcgi_params; } location /secure { internal; alias /home/ldr/webapps/nginx/app/secure/; } } } 

EDIT:

I'm trying some of the suggestions here

So I've tried:

location /secure/ { internal; alias /home/ldr/webapps/nginx/app/; } 

both with and without the trailing slash on location.

I've also tried moving this block before the "location /" directive.

The page I linked to has ^~ after 'location' giving:

location ^~ /secure/ { ...etc... 

Not sure what that signifies but it didn't work either!

Answer 1

It seems like you've misunderstood the point of x-accel-redirect. The point of this feature is to allow your backend to handle the authentication, logging and so forth and then hand the serving of the file over to Nginx.

This means you do not access the URI directly but you have your backend issue an x-accel-redirect header and Nginx will serve the file as opposed to your backend, thus freeing it up to do other stuff.

if this is actually what you do when you said I'm passing in paths in the form: "/myfile.doc" then your URI does not match the location. You are essentially giving Nginx a new request so it will do a normal location match. Thus if you want it to match location /secure/ you need to pass it a URI starting with /secure/ such as /secure/myfile.doc and Nginx would serve /home/ldr/webapps/nginx/app/secure/myfile.doc

Answer 2

Try using root instead of alias.

location /secure/ { internal; root /home/ldr/webapps/nginx/app/; }