Spoof location in nginx

Question

Nginx

Is it possible to spoof location in nginx? More specifically, does nginx canonicalize URIs (and always)?

Suppose I want to restrict access to the files/private directory by IP: I understand that in this case it was possible to do without a regular expression. This is just an example. The user can request either example.org/files/private/my.zip or http://example.org/files/./private/my.zip (normal browsers will automatically convert the second link). Will my location work in the second case? If it works, does nginx always canonicalize the URI before passing it through the config? Is this clearly stated somewhere in the documentation?
location ~ ^/files/private/.*$ {
if ($remote_addr != '127.0.0.1') {return 403;}
...
}

Answer 1

Use X-Accel-Redirect