Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : hotlinking only server...

[swfish]

hey all,...i have posted this on other forums with null help.... and now i am going to try my luck here.
how would i go about config'ing an apache server (paid host) to only allow hotlinking?
i am trying to set it up so you could call files from the server, but could
not visit the server's domain.

eg:
you could view the files like so-

    <img src="htttp//mysite.com/file.gif" />
    or
    <embed src="htttp://mysite.com/file.swf"></embed>

but, if you visited 'mysite.com' or any directories, files from the site, it
would redirect you to another *site.

*i am able to host multiple domains on the same accout usind a drectory for
each domain.

[tamasrepus]

The sureproof way that comes to my mind is to have a script processing requests. If HTTP_REFERRER is not set, redirect to another site. If it is, try to find and send the linked file.

[swfish]

i have been thinking about this and am not sure that it would work... lets say i googled 'mysite.com/file.gif' or, one could just make a link themselevs and then the HTTP_REFERER would be set...?

i will look into it more though.

thanks for the reply.

[tamasrepus]

Yes, in both those situations what I described would be defeated.

However, with a robots.txt you can tell Google to not index your files.

Yes, someone could link to the image (or fake the header), but if you want the image to remain public access there isn't a way to get around it. You could do checking to on the HTTP_REFERRER variable to see if it's from an "allowed" location (say, your forum) and perform the redirect if the validation fails.

[swfish]

Originally Posted by tamasrepus

You could do checking to on the HTTP_REFERRER variable to see if it's from an "allowed" location (say, your forum) and perform the redirect if the validation fails.

how would i go about doing this on file.gif or file.swf?