.htacess blocking downloads and on site mp3 player

not hotlinking

[nathanent]

Hi all, I'm in a bit of a pickle right now. I have a lot of mp3 files on my server that I want to protect from being downloaded. I have done the whole hotlinking thing, and that works OK. But if I know the file path, I can still download it. If I do a deny from all, it will deny the download like I want, but it also denies a flash file that plays the song in another directory. From all the reading I've done, scripts and files should still be able to access the mp3 files, but it's not so.

I would like to put the mp3 directory behind the root directory like I do php classes on other sites, so it is not web accessible, but I'm on a shared hosting plan so this is not possible, so it's not an option.

I also have an .htacess file in the root directory that rewrites URLs. It works fine, but because it is in the root dir I wonder if it overrides .htaccess files I have in child directories.

I've searched around for a long time...any thoughts?

[jdMorgan]

The basic problem is that HTTP-referrer-based access control won't work for multimedia sites, because many if not most 'media players' do not send a referrer header.

You will probably need a more sophisticated approach based on site cookies and a file-serving script to protect your content. Before going down this path, I suggest that you test to see if these players will return a cookie set by your pages with their media file requests.

Jim