How to do hotlink protection on Nginx?

Question

Nginx

You need to make certain file formats protected from hotlinking on the server with Nginx. Files are downloaded via https, by: site.com/file.exe.

The following is written in nginx.conf:

server{
    listen 80;
    server_name айпи_сервера;
    return 301 https://site.com$request_uri;

    location ~* ^.+\.(iso|img|pkg|exe|rar|zip|rar)$ {
  root /var/data/www/html/;
  valid_referers none blocked site.com www.site.com;
  if ($invalid_referer) {
  return 403;
  }
  }
}

But it doesn't work. On a direct link from another site, everything still downloads. As I understand it, the module --without-http_referer_module must be included for this. But when I asked for "nginx -V" I didn't find it. Maybe it needs to be turned on somehow? Couldn't figure out how. Thanks in advance for your replies. If anything, here is the response from the request:

configure arguments: --with-cc-opt='-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_addition_module --with-http_dav_module --with-http_geoip_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_v2_module --with-http_sub_module --with-http_xslt_module --with-stream --with-stream_ssl_module --with-mail --with-mail_ssl_module --with-threads

Answer 1

you see, antihotlink rolls only for pictures
, so - work with the parameters, there is a parameter in the query - give it for download

Answer 2

The config is correct, but you entered the check in the wrong place.
You need to enter this in the https section where you have listen 443, etc.
Now the check is entered in the http section, and it even protects against a hotlink via http, but does not work because the line with the http -> https redirect works earlier.return 301 https://site.com$request_uri;