# How to use Nginx to whitelist a specific URL

**URL:** <https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712>\
**Category:** Questions / Help\
**Created:** [October 7, 2022, 2:12pm UTC](https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712 "2022-10-07T14:12:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![swork1](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/swork1/32/6158_2.png) [@swork1](https://community.fly.io/u/swork1)\
**Post date:** [October 7, 2022, 2:12pm UTC](https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712/1 "2022-10-07T14:12:42Z")

</div>

I have an nginx docker setup. I can’t quite get the nginx.conf setup how I want it.

What I want whitelisted: **[testingexample.com](http://testingexample.com)**  
NGINX fly app: **[nginx-app.fly.dev](http://nginx-app.fly.dev)**  
Backend data app: **[backend-app.fly.dev](http://backend-app.fly.dev)**

What I want is requests from [testingexample.com](http://testingexample.com) pointed at [nginx-app.fly.dev](http://nginx-app.fly.dev) to reverse-proxy to [backend-app.fly.dev](http://backend-app.fly.dev). But I also only want to reverse-proxy if the request comes from [testingexample.com](http://testingexample.com).

I currently have this config that sets up my reverse proxy. I just need to be able to whitelist [testingexample.com](http://testingexample.com)

```auto
server {
  listen 8080;
  listen [::]:8080;

  server_name _
  proxy_set_header X-Forwarded-Host $http_host;
  proxy_ssl_server_name on;

  location /data/ {
    proxy_pass https://backend-app.fly.dev/data/;
  }
}

```

How would I go about this?

---

<div class="post-metadata">

**Author:** ![swork1](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/swork1/32/6158_2.png) [@swork1](https://community.fly.io/u/swork1)\
**Post date:** [October 7, 2022, 3:08pm UTC](https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712/2 "2022-10-07T15:08:08Z")

</div>

Another issue with this is that the user would still be able to access [backend-app.fly.dev](http://backend-app.fly.dev) directly. Is there anyway to prevent that?

---

<div class="post-metadata">

**Author:** ![greg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/greg/32/2119_2.png) [@greg](https://community.fly.io/u/greg)\
**Post date:** [October 7, 2022, 5:01pm UTC](https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712/3 "2022-10-07T17:01:06Z")

</div>

Hey,

I haven’t tried but my total guess would be to look at $host. You can see what this is from e.g this code: [https://steelywing.github.io/note/Note/Nginx/host/#validation](https://steelywing.github.io/note/Note/Nginx/host/#validation)

In _theory_:

```auto
if ($host !~* (yourhostname.com)) {
      return 403;
}

```

For an actual lookup of hostnames for allow/deny, this seems neat: [https://www.nginx.com/resources/wiki/modules/rdns/](https://www.nginx.com/resources/wiki/modules/rdns/) … _but_ it seems to have been abandoned for a while and so may not even install or work.

As for someone being able to bypass your proxy and access the [name.fly.dev](http://name.fly.dev) directly, that would remain the case. I don’t know of an option to turn off that. All I can think is you would need to not expose the _backend_ app to the public internet at all (for example don’t assign it an IP). And so (in theory) as long as your proxy was hosted by Fly, you could use `app-name.internal` as the host to proxy in your nginx. Since if the proxy was a Fly app and the backend app was _also_ a Fly app (in the same organisation), they can talk to each other over the encrypted, private network. Without needing to go over the public internet. Nobody outside of your Fly network could resolve that `app-name.internal` and thus that backend would not be available to them.

You probably need to append the port so e.g `http://app-name.internal:1234` (assuming your backend is listening on port 1234). You can use http since the connection is encrypted.

All that’s very much _in theory_!

---

<div class="post-metadata">

**Author:** ![swork1](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/swork1/32/6158_2.png) [@swork1](https://community.fly.io/u/swork1)\
**Post date:** [October 8, 2022, 2:32am UTC](https://community.fly.io/t/how-to-use-nginx-to-whitelist-a-specific-url/7712/4 "2022-10-08T02:32:47Z")

</div>

I have fixed the first issue of restricting by using the following code ‘referrer’.

```auto
 server {
  listen 8080;
  listen [::]:8080;

  server_name frontend.fly.dev;

  valid_referers server_names localhost;

  if ($invalid_referer) {
          return 402;
  }

  location / {
          proxy_set_header X-Forwarded-Host $http_host;
          proxy_ssl_server_name on;
          proxy_pass https://backend.fly.dev/;
  }

  location /data/ {
          proxy_set_header X-Forwarded-Host $http_host;
          proxy_ssl_server_name on;
          proxy_pass https://backend.fly.dev/data/;
  }
}

```

I would now like my [backend.fly.dev](http://backend.fly.dev) to only be accessible to my [frontend.fly.dev](http://frontend.fly.dev). Greg mentioned using a .internal but I can find anything on them. Does someone have some insight/docs.