Mod_rewrite to prevent direct accessing of images

Allow use of images with pages, but prevent if accessed directly

[premasagar]

Hello!

I want to add something to .htaccess to prevent certain images from being accessed directly through the browser's URL address bar.

That is, any images accessed from within pages should display as normal, but if someone types:
www.mysite.com/images/protect/pic.jpg
then they will get a 403 or a different page.

What I have at the moment also prevents access from within pages:

Options FollowSymLinks
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*/images/protect/.*$
RewriteRule ^.*$ - [F]

Any thoughts?
Thx, Prem.

[Longhaired Genius]

This should work:

Options FollowSymLinks
RewriteEngine On
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://yourdomain.com.*$
RewriteRule .*\.(gif¦jpg¦jpeg)$ - [F,NC]

Many refinements and adjustments are possible. There's a wealth of information in this forum so be prepared to do some digging.

[jdMorgan]

premasagar,

Be aware that if you want to block direct type-in access, you'll have to block blank referrers, since this is what your server will see if the user types the image URL into his browser. The problem is that many users who *are* accessing the image by viewing your page will also be blocked if you do this. This can lead to huge "customer support" problems.

About the best you can do using HTTP_REFERER is to block image viewing from links on *other* Web sites (hotlinking) for cases where a referrer *is* provided. It's an imperfect solution, but the fact is that you cannot rely on HTTP_REFERER. See message number 5 of this recent thread [webmasterworld.com] for more info.

Better solutions do exist, such as the use of cookies, but all are more complex that simple mod_rewrite blocking based of referrer.

Jim

[premasagar]

Thank you for your replies.

Yes Jim, I was planning to cover non-blank refferals that come from outside my site. But I thought it might be possible to detect if the user had specifically typed a URL containing, say, ".jpg" into the browser address bar. But the ReWrite should not so anything if the request came from within an HTML page itself. Not possible, huh?

I don't really know my cookies, and I guess I wanted just a simple one-time solution.

Thanks,
Prem.