title: Secure Site Backend URL with Random Key and NGINX
body: <p>I'm using <a href="https://octobercms.com/" rel="nofollow noreferrer">OctoberCMS</a> and <a href="https://www.nginx.com/" rel="nofollow noreferrer">NGINX</a>.</p>
  
  <p>I want to secure the site's Backend Signin url with a random generated key and NGINX sites-available.</p>
  
  <p>The only way to get to the Signin page is use the secure key in the url or bookmark it.</p>
  
  <hr>
  
  <h3>Secure Key</h3>
  
  <p>I have this code which worked with Joomla when using the <code>/administrator</code> path.</p>
  
  <p>Though OctoberCMS uses <a href="https://github.com/octobercms/october/issues/173#issuecomment-43571766" rel="nofollow noreferrer">/backend/backend/auth/signin</a>.</p>
  
  <pre><code>if ($http_referer !~ "^/backend/backend/auth/signin"){
      set $rule_0 1$rule_0;
  }
  if ($args !~ "^vhXmdqLx1lkNQ46f5egC"){
      set $rule_0 2$rule_0;
  }
  if ($rule_0 = "21"){
      rewrite ^/.*backend/backend/auth/signin/? /404 redirect;
  }
  </code></pre>
  
  <p>It works on the Signin page, but once logged in  it redirects to 404, because other pages in <code>/backend</code> are not included in the code.</p>
  
  <hr>
  
  <h3>Wildcard</h3>
  
  <p>I tried adding a wildcard (*) to the uri like this, but it gave the same 404 result:</p>
  
  <pre><code>if ($http_referer !~ "^/backend/backend.*"){
      set $rule_0 1$rule_0;
  }
  if ($args !~ "^vhXmdqLx1lkNQ46f5egC"){
      set $rule_0 2$rule_0;
  }
  if ($rule_0 = "21"){
      rewrite ^/.*backend/backend.*/? /404 redirect;
  }
  </code></pre>
  
  <hr>
  
  <p>Notes: </p>
  
  <ul>
  <li>The secure key is just an example I generated, not the real key.</li>
  <li>Trying <code>/backend</code> instead of <code>/backend/backend</code> ruined the
  backend's css url's, because the css links in the html were requiring the secure key.</li>
  </ul>