title: Nginx Config, Deny Image Stored in Specific Folder If $http_cookie Isn't Set
body: <p>I am currently launching a WordPress site that moves image uploads into a certain folder when they are added. On my development server I have made it so that images stored in this folder are NOT ACCESSIBLE, unless a specific $http_cookie is set in the browser. Here is the location block I'm using for this in my development NGINX config:</p>
  <pre><code>location ~ ^/wp-content/uploads/employee_message/(.*) {
          if ($http_cookie !~ 'wp_2651267=user_employee123') {
                  return 301 https://sitename.com;
          }
  }
  </code></pre>
  <p>On the development server, when I view a file such as <a href="http://sitename.com/wp-content/uploads/employee_message/1234-5678-1234-5678/image_here.png" rel="nofollow noreferrer">http://sitename.com/wp-content/uploads/employee_message/1234-5678-1234-5678/image_here.png</a> for example, it will only allow me to view that if the I have the wp_2651267=user_employee123 cookie set. This is good.</p>
  <p>However, when I move this location block into my production config (I'm using RunCloud) it allows the image to be viewed with or without the cookie. This is no good.</p>
  <p>I'm seeing that this location block below is part of the default config, and my block above gets pulled in AFTER this one:</p>
  <pre><code>location ~ .(ico|css|gif|jpe?g|png|gz|zip|flv|rar|wmv|avi|css|js|swf|png|htc|mpeg|mpg|txt|otf|ttf|eot|woff|woff2|svg|webp)$ {
      expires     1M;
      include /etc/nginx-rc/conf.d/sitename.d/headers.conf;
      add_header  Cache-Control &quot;public&quot;;
      include /etc/nginx-rc/extra.d/sitename.location.static.*.conf;
      try_files $uri $uri/ /index.php$is_args$args;
  }
  </code></pre>
  <p>Is it possible that this is undoing the cookie business I'm adding in?</p>
  <p>Here is an example config that RunCloud uses: <a href="https://runcloud.io/docs/guide/cheat-sheet/nginx" rel="nofollow noreferrer">RunCloud NGINX Config</a></p>
  <p>My location block gets pulled in on this line:</p>
  <pre><code>include /etc/nginx-rc/extra.d/runcloud-blog.location.main.*.conf;
  </code></pre>
  <p>There are no errors when I run a test, and it has definitely been reloaded many, many times. Are there any reasons that my location block isn't working in this setup? Is there more information I can provide to help troubleshoot this?</p>
  <p>Thanks so much for taking the time to read this! Please let me know if you have any insights.</p>
  <p>Thanks,
  -Ryan</p>