refer 和防盗链

valid_referers none | blocked | server_names | string ...;

none                 没有 refer 请求头
    the "Referer" field is missing in the request header;

blocked              refer 请求头被删除了
    the "Referer" field is present in the request header, but its value has been deleted by a firewall or proxy server;
    such values are strings that do not start with "http://" or "https://";

server_names         包含任意一个域名
    the "Referer" request header field contains one of the server names;

arbitrary string     任意字符串
    defines a server name and an optional URI prefix. A server name can have an "*" at the beginning or end. During the checking, the server‘s port in the "Referer" field is ignored;

regular expression   正则表达式
    the first symbol should be a "~". It should be noted that an expression will be matched against the text starting after the "http://" or "https://".

Example:
    valid_referers none blocked server_names
                   *.example.com example.* www.example.org/galleries/
                   ~\.google\.;

location ~* \.(gif|jpg|jpeg|png|bmp|swf|flv)$ {
    valid_referers none blocked www.xxx.com *.xxx.com;
    if ($invalid_referer) {
        rewrite ^/(.*) http://www.xxx.com/blocked.html;
    }
}