Anti-image leeching configuration in the nginx + Tomcat Environment

I thought it was a simple task. I have read the details carefully and need to pay attention to them. The Internet is basically only configured in the nginx environment. Here is a brief description of the configuration using the nginx + Tomcat structure. There are two main steps to select any solution.

1. nginx anti-leech Configuration

A. Method 1: add the ngx_http_accesskey_module. However, you need to configure the ngx_http_accesskey_module. I will not repeat the relevant information on the Internet.

■ Advantages: the control logic is strict and the solution is very reliable.

■ Disadvantages: more modifications are required.

B. Method 2: directly add the refer judgment and prohibit requests that do not meet the Preset conditions. Note that the backend has tomcat, so the configuration of proxy pass must be added.

# To prevent image leeching, only determine whether refer is the location of this site ~. *\. (GIF | JPG | JPEG | PNG | BMP | SWF) $ {valid_referers none blocked * .taoximao.com taoximao.com; if ($ invalid_referer) {return 403 ;} # Add the backend access address proxy_redirect off; proxy_pass http: // web_server; proxy_set_header host $ host; proxy_set_header X-real-IP $ remote_addr; proxy_set_header X-forwarded-for $ proxy_add_x_forwarded_for ;}

■ Advantages: the configuration is quite simple, and no other modules need to be installed.

■ Disadvantages: it cannot prevent others from forging refer information. That is to say, if people really want to steal the refer information, they still cannot stop it. In addition, if the refer is empty, they still can access the refer normally, the control is very wide.

2. configuration of Tomcat direct access prohibited

(Note: If Tomcat can still be accessed directly, the anti-leech of nginx does not make sense. You can skip the configuration by adding a port)

A. Method 1: Configure iptables in Linux and disable Internet access from port 8080. In this way, you can only access it through nginx. I will not repeat a lot of information on the Internet.

■ Advantages: direct system-level configuration, independent from the application itself, and highly reliable.

■ Disadvantages: Additional configuration is troublesome.

B. Method 2: directly configure the access IP addresses allowed by Tomcat to be precise to each host. You only need to modify the conf/server. xml file in Tomcat and add the allowed IP address to the host. If you access the file directly, error 403 is returned.

      <Host name="test1.taoximao.com"  appBase="webapps_test1"            unpackWARs="true" autoDeploy="true"            xmlValidation="false" xmlNamespaceAware="false">        <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1" deny=""/>      </Host>

■ Advantages: the configuration is simple, and the implementation effect can also meet the needs.

■ Disadvantages: there are few introductions on the Internet. Check the official documents.

Anti-image leeching configuration in the nginx + Tomcat Environment