基本原理

? 通過(guò)referer來(lái)進(jìn)行判斷和限制，因?yàn)?strong>HTTP Referer是header的一部分，假設(shè)瀏覽器訪問(wèn)某網(wǎng)頁(yè)上的一張圖片資源但是該資源來(lái)自其它站點(diǎn)，那么瀏覽器的請(qǐng)求的referer部分也會(huì)帶著原網(wǎng)站的信息去請(qǐng)求這種圖片資源，如果這個(gè)站點(diǎn)設(shè)置了防盜鏈規(guī)則，就可以起到一定的訪問(wèn)控制功能。

ngx_http_referer_module模塊

語(yǔ)法： valid_referers none | blocked | server_names | string ...;
可用于： server, location

none: 檢測(cè)請(qǐng)求頭中不帶Referer字段，Referer字段為空。
blocked： 檢測(cè)Referer字段出現(xiàn)在請(qǐng)求頭中，但是值已經(jīng)被防火墻或者代理服務(wù)器刪除的情況。
server_names: 域名，檢測(cè)Referer頭中的值是否在這些域名中。

配置使用

 location ~* \.(?:jpg|jpeg|png)$ {
        expires 1M;
        add_header Cache-Control "public";
        valid_referers none blocked *.baidu.com;
    if ($invalid_referer) {
        return 403;}
        }

先用location匹配出資源文件類(lèi)型，然后用valid_referer指令設(shè)置白名單也就是允許的域名，其它域名沒(méi)有在valid_referers列表中，$valid_referer變量返回的值為1，

補(bǔ)充說(shuō)明

使用curl自定義請(qǐng)求頭測(cè)試某云CDN防盜鏈相關(guān)的功能

1.將referer設(shè)置錯(cuò)誤。
[root@iZ2zej4i2jdf3mpednw9vrZ ~]# curl -I https://su1105.kivensu.club/001.jpg -H 'Referer:http://sby1105.kivensu.club/'
HTTP/1.1 403 Forbidden
Server: Tengine
Date: Thu, 07 Nov 2019 06:17:10 GMT
Content-Type: text/html
Content-Length: 254
Connection: keep-alive
Strict-Transport-Security: max-age=5184000
X-Tengine-Error: denied by Referer ACL
Via: kunlun8.cn1474[,403003]
Timing-Allow-Origin: *
EagleId: dede581c15731074305801803e

2.將referer設(shè)置為空。
[root@iZ2zej4i2jdf3mpednw9vrZ ~]# curl -I https://su1105.kivensu.club/001.jpg 
HTTP/1.1 403 Forbidden
Server: Tengine
Date: Thu, 07 Nov 2019 06:17:30 GMT
Content-Type: text/html
Content-Length: 254
Connection: keep-alive
Strict-Transport-Security: max-age=5184000
X-Tengine-Error: denied by Referer ACL
Via: kunlun8.cn1474[,403003]
Timing-Allow-Origin: *
EagleId: dede581c15731074506567942e

3.將referer設(shè)置正確。
[root@iZ2zej4i2jdf3mpednw9vrZ ~]# curl -I https://su1105.kivensu.club/001.jpg -H 'Referer:https://www.baidu.com'
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 79033
Connection: keep-alive
Strict-Transport-Security: max-age=5184000
Date: Thu, 07 Nov 2019 06:10:49 GMT
Last-Modified: Mon, 04 Nov 2019 06:15:49 GMT
ETag: "5dbfc215-134b9"
Expires: Sat, 07 Dec 2019 06:10:49 GMT
Cache-Control: max-age=2592000
Cache-Control: public
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1573107049
Via: cache17.l2cm9-5[23,200-0,M], cache4.l2cm9-5[25,0], kunlun10.cn1474[0,200-0,H], kunlun8.cn1474[2,0]
Age: 434
X-Cache: HIT TCP_HIT dirn:10:539000673
X-Swift-SaveTime: Thu, 07 Nov 2019 06:10:49 GMT
X-Swift-CacheTime: 2592000
Timing-Allow-Origin: *
EagleId: dede581c15731074830701514e

4.將referer設(shè)置正確，useragent設(shè)置為黑名單。
[root@iZ2zej4i2jdf3mpednw9vrZ ~]# curl -I https://su1105.kivensu.club/001.jpg -H 'Referer:https://www.baidu.com UserAgent:edge'
HTTP/1.1 403 Forbidden
Server: Tengine
Date: Thu, 07 Nov 2019 06:28:13 GMT
Content-Type: text/html
Content-Length: 254
Connection: keep-alive
Strict-Transport-Security: max-age=5184000
X-Tengine-Error: denied by Referer ACL
Via: kunlun6.cn1474[,403003]
Timing-Allow-Origin: *
EagleId: dede581a15731080932208007e

5.設(shè)置URL鑒權(quán)和正確的referer。
[root@iZ2zej4i2jdf3mpednw9vrZ ~]# curl -I https://su1105.kivensu.club/001.jpg?auth_key=1573117732-0-0-0e32e263bb8c64bb43f224d82f794ae2 -H 'Referer:https://www.baidu.com'
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/jpeg
Content-Length: 79033
Connection: keep-alive
Strict-Transport-Security: max-age=5184000
Date: Thu, 07 Nov 2019 06:10:49 GMT
Last-Modified: Mon, 04 Nov 2019 06:15:49 GMT
ETag: "5dbfc215-134b9"
Expires: Sat, 07 Dec 2019 06:10:49 GMT
Cache-Control: max-age=2592000
Cache-Control: public
Accept-Ranges: bytes
Ali-Swift-Global-Savetime: 1573107049
Via: cache17.l2cm9-5[23,200-0,M], cache4.l2cm9-5[25,0], kunlun10.cn1474[0,200-0,H], kunlun2.cn1474[194,0]
Age: 7146
X-Cache: HIT TCP_HIT dirn:10:539000673
X-Swift-SaveTime: Thu, 07 Nov 2019 06:10:49 GMT
X-Swift-CacheTime: 2592000
Timing-Allow-Origin: *
EagleId: dede581615731141953898826e