blocking CSS & JS access

[sssweb]

I want to block users from directly viewing my CSS & JS files, etc. In searching the forum, I found this thread:

[webmasterworld.com...]

which suggests the code:

RewriteEngine on
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mysite\.net
RewriteRule \.(js|css)$ - [F]

But, as I finally learned through jdMorgan's persistent advice, this allows users to view the file through the address bar, exactly what the poster in the above thread (and me) want to block. I verified this in testing. So I suppose the same 'hole' exists here as with image protection? If I'm missing something; please fill me in.

As an alternative for this method, I also came across this:

[webmasterworld.com...]

Is it fairly easy to deliver these files via PHP, then deny HTTP access from all?

[jdMorgan]

Whether you deliver the files by PHP or directly, the issue is "how do you decide to deliver them or not?"
You can do this based on the referer only to the extent that the referer is present *and* legitimate -- It could be (easily) spoofed. If the referer is blank (as it will be with a direct type-in address), you must allow access to avoid making your site look broken to all users behind ISP or corporate proxies.

So, we're back to the cookie-and-script method described in the first-cited thread. This makes the files accessible only if the requestor has previously fetched the HTML page that the CSS and JS are supposed to be included on. And even that is not bulletproof, since cookies can be copied or spoofed. So, this method may not be 'good enough' for you either.

The bottom line is, if you don't want it accessible on the Web, then don't publish it on the Web. Very few CSS files or JavaScripts are unique or clever enough to warrant extensive protection. And if they are, then they should be on a password-protected site away from general view. Earnestly, I suggest spending time on more productive endeavors...

Jim

[sssweb]

Earnestly, I suggest spending time on more productive endeavors...

Thanks, I will.