Can I forbid download from external links?

Contribute Feature
5

The browser won’t, the server can. By default, when a browser makes a request to the same origin as the page with the reference, it will include a referrer header to tell the server where it came from. A server can use this information to influence behaviour, including allowing/denying access to certain locations.

It’s easy to circumvent but it prevents casual linking from other websites.

location /uploads/ {
    valid_referers  www.example.com;
    if ($invalid_referer) {
        return 403;
    }
}

Replacing www.example.com in the above code with the domain of your Discourse instance should be appropriate nginx config to prevent hotlinking to the uploads on your instance.

You may also want to do something different than return 403, (not allowed) for example you may want to redirect to your Discourse home page. To do that, you could use the following code instead.

location /uploads/ {
    valid_referers  www.example.com;
    if ($invalid_referer) {
        return 307 /;
    }
}

It should be possible to add something to your app.yml file to inject the config during a rebuild. That part I’m not sure how to do though, I haven’t looked into it in any great detail.

4 Likes