right way to prevent hotlinking?

classic way is not working for me, just the other way

[dehumanizer]

Hello there!

I was trying to build something in .htaccess to prevent hotlinking from my domain images.

I found in many places this example to be the most common way to work:

RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://mydomain.com/.*$ "NC"
RewriteCond %{HTTP_REFERER}!^http://www.mydomain.com/.*$ "NC"
RewriteCond %{HTTP_REFERER}!^http://www.friendly.com/.*$ "NC"
RewriteRule .*\.(gif¦GIF¦jpg¦JPG)$ - "F"

This may look funny, but doesnt work at all for me, pictures will always be displayed no matter what. However the following is doing what I want, this .htaccess is placed together with the images:

AuthUserFile /dev/null
AuthGroupFile /dev/null
RewriteEngine On
RewriteCond %{http_referer}!^http://www.mydomain.com/
RewriteRule /* http://www.mydomain.com/ [R,L]

The problem now is that it only works if the .htaccess is inside the dir along with the images.

Right now I have lots of albums like, "albums/user1/album1, albums/user2/album1, albums/user3/album5, etc". If I place the .htacces inside albums/ then the redirection will always happen no matter the referer is, if I place the .htaccess inside albums/user1/album1/, then everything is fine.

The problem here is that everytime an album is created PHP will copy the .htaccess to the new folder, not sure if there is a problem with that, but maybe just having one .htaccess to deal with hotlinking would be better.

Also, here is the .htaccess located in the root:

RewriteEngine on
Options +FollowSymlinks
RewriteBase /
RewriteRule ^products/([a-zA-Z0-9\]+)/([a-zA-Z0-9\+\ ]+)$ index.php?section=products&category=$1&title=$2 [L]
RewriteRule ^news/([a-zA-Z0-9\]+)$ index.php?section=news&newsid=$1 [L]
RewriteRule ^articles/([a-zA-Z0-9\]+)$
index.php?section=articles&articleid=$1 [L]

First I thought the root .htaccess would override the .htaccess in subdirs, however, like I said, those .htaccess inside the user albums are doing their job fine.

Sorry for the mess, I began with mod_rewrite this week.

Best regards,

- Michaelsen

[jdMorgan]

The problem you are having with your modified code is that your RewriteRule pattern "/*" means, "match any URL containing any number of slashes (including zero), so it essentially matches all files.

See the regular-expressions tutorial cited in our charter [webmasterworld.com] for more info.

A corrected and optimized version of the first code you posted is:

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain\.com [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?friendly\.com [NC]
RewriteRule \.(gif¦jpg)$ - [NC,F] 

Jim

[dehumanizer]

Hi Jim,

Maybe is something with Apache, it just doesn't work.

Just the second piece of code I pasted above does work. Can I use that for now? It allows me to display pictures just for people logged in the site.

Thank you again!

- Michaelsen

[dehumanizer]

I'm reading the tutorial. Good stuff!

Best regards,

- Michaelsen

[jdMorgan]

Reviewing this thread, I notice that no-one has stated this often-repeated warning:

Be sure to change all broken pipe "¦" characters to solid pipe (usually Shift-\) characters before use. Posting on this forum modifies those characters. Broken pipe characters will cause a 500-Server Error in Apache.

Jim