I’m writing yet another blog post explaining a problem (and hopefully its solution) that I haven’t found the answers on the internet.
Internal URLs
We have a few largish (~5GB) files that we need to protect access via login in our Django app. Because we are using Nginx as the fronted, the solution is trivial:
The Nginx configuration:
location /protected/ {
internal;
alias /real/dir/where/protected/files/are/;
}
The django view:
# in the correct access part of the view
response = HttpResponse()
response['X-Accel-Redirect'] = '/protected/' + file_name
return response
It works fine, with the outside access being through the Django view, where we can enforme @login_required.
Ranges
Because the files are huge, the Javascript component we are using tries to skip and load certain byte ranges of the file, instead of downloading everything to the browser (super-slow and memory-hungry).
The Ranges HTTP header allows the client to request a range of byte addresses in the file, that are served with a custom error (206 Partial Content) and other specific headers.
Nginx supports ranges, so if the files were being served without the previous authentication approach, it works flawlessly.
The problem
Django does not support ranges. And our webapp starts emitting errors unzipping the parts of the big file that worked without Django. My guess is that either Nginx does not support Ranges when coming from X-Accel internal redirection, or Django emits some kind of content in the HTTP request that will prevent Nginx from starting the request afresh.
Next Steps
- Create a MVE with a basic client, so we can test different configurations.