ngx_http_secure_link_module
Check link authenticity and expiry with MD5 hashes
Overview
ngx_http_secure_link_module (0.7.18) checks the authenticity of requested links, protects resources from unauthorized access and limits link lifetime. It compares a checksum passed in the request with one computed on the server, and if the link carries an expiration time that has passed it is treated as outdated.
There are two operation modes. secure_link_secret checks a hexadecimal MD5 of the link plus a secret word embedded in the URI as /prefix/hash/link. The second mode (0.8.50) uses secure_link and secure_link_md5: the request supplies a base64url MD5 hash and optionally an expiration time in seconds since the Epoch, and the hash is computed over any expression, typically including $uri, $remote_addr, a secret and $secure_link_expires. The outcome is exposed in $secure_link.
It is an official nginx module that upstream does not build by default; it needs the --with-http_secure_link_module configure parameter. A typical use is issuing time-limited download URLs from an application while nginx serves the files directly.
Key directives
secure_linkString with variables from which the checksum and, after a comma, the expiration time are extracted.secure_link_md5Expression whose MD5 is compared with the hash from the request; should include the resource, a secret and $secure_link_expires.secure_link_secretSecret word for the /prefix/hash/link URI scheme, where hash is the hex MD5 of link plus word; location context only.$secure_linkEmpty on checksum mismatch, "0" when expired, "1" when valid; in secret mode it holds the extracted link.$secure_link_expiresExpiration time passed in the request, intended only for use inside secure_link_md5.Example
Availability
Compiled into every n.wtf nginx binary. Install nginx-extras and the directives above work out of the box, no load_module line needed.