使用 curl 和 nginx 检查站点用户是否存在

Question

On my site, registered users, after logging in, have the possibility to download files with the curl command, ie

curl -O https://example.com /assets/file/test.txt

I would like to somehow avoid that the user not logged in or deleted still has the possibility to download the file by running the command again or by going directly to the address from the browser.

I use Nginx as web server.

Is it possible to block access to the user that no longer exists or is no longer logged in?

I had thought about the possibility of doing something like this:

curl -u {{user.id}}:{{unique_value}} https://example.com/assets/file/test.txt

or

curl -O https://example.com/assets/file/test.txt?param={{unique_value}}

But I don't know how to verify the existence of the user, and if it is possible to do so, with nginx or some other tool.

I tried using cookie control with Nginx, but as far as I know it is easy to circumvent.

Answer 1

yeah you can use http basic auth to restrict file access to authorized people, per the documentation at https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

touch /etc/nginx/users.htpasswd;
htpasswd /etc/nginx/users.htpasswd user1 'password';

followed by

server {
        listen 80;
        listen [::]:80
        location /assets{
            root /wherever/assets/..;
            auth_basic           "assets";
            auth_basic_user_file /etc/nginx/users.htpasswd; 
        }
}

now only curl -u user1:password1 can download files in /assets/