Forum Moderators: phranque
the sub.example.com has mp3 files and i want to block users from downloading these files (directly downloading it from their browser or something in case if they find the links to the mp3 files) or even accessing the site at all and only allow access to these mp3 file or the whole site from http://example.com (probably through HTTP_REFERER from which the files will be stream)
can someone help write an mod_rewrite that can achieve this or suggest better ways to accomplish this task.
[edited by: jdMorgan at 4:40 am (utc) on June 15, 2007]
[edit reason] example.com [/edit]
Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example\.com [NC]
RewriteRule \.mp3$ - [F]
[edited by: jdMorgan at 8:35 pm (utc) on June 15, 2007]
[edit reason] Corrected the spacing issue cited below. [/edit]
is this code suppose to make the .mp3 files only available through referral of the stated site cos that what i really want
this config is supposed to check that there is a referrer and that the referrer is not either example.com or www.example.com.
if both conditions are met, it should send a 403 code (Forbidden)
check your logs to see what the referrer string is and for hints on what caused the internal server error.
RewriteCond: bad argument line '%{HTTP_REFERER}!^http://(www\\.)?example\\.com[NC]'\n
but i will try it again now
and one more thing, what if the example.com is example.com.uk where will add the .uk?
Phranque's code is correct, and the .co.uk is the only important change here:
Options +FollowSymLinks
RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example\.co\.uk [NC]
RewriteRule \.mp3$ - [F]
Occasionally, we run into character-set problems here as well; If you are seeing any 'weird' characters in the code, let us know. They should all be characters in the U.S.-ASCII character set, as that is what was used to build Apache.
Jim
will the code if u want a specific file or directory to have access to the .mp3 files thru referral?
Jim
RewriteCond: bad argument line '%{HTTP_REFERER}'\n
but after adding!^$ to RewriteCond %{HTTP_REFERER} to make it become
RewriteCond %{HTTP_REFERER}!^$
no more error, but it didn't solve the problem, i was still able to download the song directly from the browser by typing the link into the address bar
RewriteCond: bad argument line '%{HTTP_REFERER}'\n
You got this error because you left off the period. "." and "!^$" are logically equivalent, but "." is shorter.
Type-in access will be allowed, because a directly-typed-in URL by definition has no referrer.
If you want to block type-ins while not blocking legitimate users whose security software, ISP, or corporate network blocks HTTP referrers, you will need a script-and-cookie-based solution, or a solution that involves renaming the files periodically and updating your pages to point to the new URLs.
Because there are many music/video sites with this same problem, I suspect you should be able to buy an off-the-shelf script reasonably cheaply.
Jim
You should be able to find something by doing a few searches and by looking at PERL and PHP script archive sites.
The concept is simple: When a visitor visits an "authorizing" page on your site, a short-term session cookie is set in his browser. When the visitor requests a media file, his request is handled by a script. The script checks that the cookie exists and has not expired. If the cookie is good, then the script opens the media file and sends the contents to the visitor. If the cookie does not exist, has expired, or is otherwise invalid, the script sends a redirect to the visitor, sends an alternate file, or sends an "access denied" response -- your choice.
Jim
