.htaccess help needed!

Specifically referrers

[kevmeister]

Since I'm not an expert at this, I'll start at the beginning in case I explain it wrong.

A friend started a Yahoo group for a certain model he likes and asked me to build a separate website for the galleries since Yahoo doesn't give that much hosting space and is generally a dog to use, but he wanted users to only be able to access it from within the group.

I knew this could be done using a .htaccess file so I did a bit of Googling and set one up, only to encounter a couple of problems. Firstly, some users could still not access the site even after clicking the link from within the Yahoo group, and secondly, the .htaccess file caused some problems with the forums I'd set up for the site. Every time someone posts a message, a script brings up a window telling the user their message has been posted, and redirects the page back to their new message. Or at least it should, but instead they get redirected to the error page I set up that users who try to access the site from outside the Yahoo group usually see.

I'm figuring that I just made an error with the .htaccess file since I don't really understand it all that well (the file I put together was a copy and paste job with a few alterations, lol), so I was wondering if anyone could tell me what I'd need to put in it?

I suppose some idea of the URL's would help, so:

(The Yahoo group)
/http://groups.yahoo.com/group/nameofmodel/

(The main site)
/http://www.mysite.com/nameofmodel/

(Where the forum is located)
/http://www.mysite.com/nameofmodel/forum/

I hope that made sense! Any help would be appreciated. :)

[jdMorgan]

kevmeister,

Welcome to WebmasterWorld!

I'll guess you are blocking blank referrers, and this is causing your problem. Many visitors will be using browsers or internet security software that blocks HTTP referrer headers, or be accessing the 'net from behind their corporate or ISP proxy that blocks referrers. This would include, for example, all AOL users.

You must allow access by "correct" referrer *and* by blank referrer. This admittedly opens a hole in your anti-hotlinking control scheme, but it is the best you can do with HTTP referrer-based access control.

Do a search here on WebmasterWorld for "hotlinking blank referrer" for more information.

Jim

[kevmeister]

Okay...I tried this:

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^http://(www\.)?mysite.com.*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://(www\.)?groups.yahoo.com/group/nameofmodel.*$ [NC]
RewriteRule .* http://www.mysite.com/errorpage.html [R,L]

And posting on the forums still redirects me to the error page. :(

Am I missing something or is this just too clunky a solution?

[gergoe]

Try this one:

RewriteEngine on 
RewriteCond %{REQUEST_URI} !^errorpage.html$ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mysite.com(/.*)?$ [NC]
RewriteCond %{HTTP_REFERER} !^http://groups.yahoo.com/group/nameofmodel(/.*)?$ [NC]
RewriteRule .* http://www.mysite.com/errorpage.html [R,L]

...which redirects the browser to the error page if

• the requested page is not the error page itself,
  
• the referer header is not empty (see the post of jdMorgan),
  
• the refering url is not from your site
  
• and the refering uri is not the yahoo group.
  

[jdMorgan]

That should work, but add a slash to this line:

RewriteCond %{REQUEST_URI} [b]!^/e[/b]rrorpage.html$ [NC]

Jim

[kevmeister]

Cheers peeps...will give it a try. It solved the problem with the forum, now I just hope I don't get too many outside visitors.