Execution order

[edelen]

Wondering about execution order on rewrites.

For instance, if I want to allow hotlinking from "(subdomain).live.com" but not from "(subdomain).spaces.live.com", would the following be correct

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER}!^http://([^.]+\.)*live\.com
RewriteCond %{HTTP_REFERER} ^http://([^.]+\.)*spaces\.live\.com
RewriteRule \.(jpe?g¦gif¦bmp¦png)$ - [F]

or would I swap lines 3 and 4? I'm not certain how Apache treats the rewrite, whether it matches a condition and then goes no further OR it matches and condition then moves on to a condition that may modify the previous condition.

Thanks in advance.

[jdMorgan]

No, there is no if-then-else involved here.

All RewriteConds are ANDed together by default. If any one is false, the rules is skipped.
If you use an [OR] flag on a RewriteCond, then it will be ORed with the following RewriteCond -- If neither one is true, then the rule will be skipped.

Just list out the referring domains that you wish to allow access for, using the negative-match ("!" operator) form, and that's all you'll need, apart from the exclusion for blank referrers. Accesses referred by any other domain not in the list will be denied.

RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://([^.]+\.)*your_domain\.com
RewriteCond %{HTTP_REFERER} !^http://([^.]+\.)*other_allowed_domain\.com
RewriteCond %{HTTP_REFERER} !^http://([^.]+\.)*another_allowed_domain\.com
RewriteRule \.(jpe?g¦gif¦bmp¦png)$ - [F]

Replace the broken pipe "¦" characters above with solid pipe characters before use; Posting on this forum modifies the pipe characters.

Jim

[edelen]

Jim,

Say I wanted to allow "(subdomain).live.com" but wanted to block access from their MySpace-like "(subdomain).spaces.live.com" (plus exclude some others like it like "groups.yahoo.com"). Could I do this:

RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http://([^.]+\.)*spaces\.live\.com
RewriteCond %{HTTP_REFERER} ^http://groups\.yahoo\.com
RewriteRule \.(jpe?g¦gif¦bmp¦png)$ - [F,L]

Then follow that in my .htaccess with

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER}!^http://([^.]+\.)*live\.com
RewriteCond %{HTTP_REFERER}!^http://([^.]+\.)*yahoo\.com
RewriteRule \.(jpe?g¦gif¦bmp¦png)$ - [F]

Would that work to stop Live Spaces and Yahoo Groups hotlinking THEN allow for everything else?

Thanks for the help and for helping me learn how this all works. (Teach a man to fish, right?)

[jdMorgan]

No because in the first ruleset, the referrer would have to be BOTH http://xyz.spaces\.live\.com AND
http://groups\.yahoo\.com at the same time to get blocked... an obvious impossibility. As mentioned above, you'll need to put an [OR] flag on the first RewriteCond. ;)

With that change, the code should work as you describe.

Also, [F,L] is redundant, because [F] always implies [L] -- See the RewriteRule Flags documentation, and look for the key-word "immediately." Those flags so noted don't need an [L] flag, because they act immediately.

And to wrap it up, you only need one "RewriteEngine on" in your file, unless you want to turn it off to disable some rules and then turn it back on again later in the file -- For example, to avoid having to comment-out each line in a large block of rules...

Jim

[edited by: jdMorgan at 8:43 pm (utc) on April 20, 2007]