htaccess, iframes, and stopping hotlinking

Graphics are not showing on my site with pages with iframes

[mikemwe]

I want to stop image hotlinking using the following:

# stop hotlinking and serve alternate content
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?example\.com/.*$ [NC]
RewriteRule .*\.(gif¦jpg)$ http://www.example.com/this-image-was-stolen.jpe [R,NC,L]
</ifModule>

In some cases, I have a secure page (SSL), with an iframe to a secure form from another site.

When I add the above code, it works fine, but on these SSL pages with iframes, the graphics won't show.

What am I doing wrong, or how can I overcome that?

[edited by: jdMorgan at 7:13 pm (utc) on June 8, 2007]
[edit reason] example.com, tidy-up [/edit]

[mikemwe]

I should make a note. I also have an htaccess file in the directory with the secure page to turn it into a secure page. Does this have something to do with it?

[jdMorgan]

Well, the code pretty clearly redirects requests from any referrer not starting with "http://", so that leaves out "https://"...

The fix is to make an "s" after "http" optional. Along with some other clean-ups and optimizations:

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^htt[b]ps?:[/b]//(www\.)?example\.com [NC]
RewriteRule \.(gif¦jpg)$ http://www.example.com/this-image-was-stolen.jpe [NC,R=302,L]

Replace the broken pipe "¦" character in the rewriterule pattern with a solid pipe character before use; Posting on this forum modifies the pipe characters.

Jim

[mikemwe]

I just actually found out right before you posted your repsonse. I used this line:

RewriteCond %{HTTP_REFERER}!^(http¦https)://(www\.)?mysite\.com.*$ [NC]

I needed the code for both and I didn't know how to write it. It works like a charm.

Thanks for your response though. I'm a newbie, but I must say I have a pretty extensive htaccess file now!