block hotlinking specific subdomain

[CNibbana]

Hi there,

I searched and couldn't find anything that met my specific situation. I am using the following to block hotlinking to my site:

RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://([^.]+\.)?domain\.[NC]
RewriteRule \.(zip|gif|png|swf|flv|jpe?g $ - [F]

Recently I setup a subdomain pointer cdn.domain pointing toward my root directory so I can serve images, etc. in parallel to speed up page load times. I also have other subdomains on the site.

When I check external hotlinking from [cdn.domain.com...] it allows images thru.

How can I alter the code to allow hotlinking from internal subdomains and block cdn.domain to the outside world?

[lucy24]

I hope those are simply typos in your example. You've got a missing space on one line matched by a superfluous space on the next. Either one would probably lead to a 500 error.

The rule has to be located where the subdomain can see it. That means its physical location in the site's directory structure, not its visible URL. I'm inclined to suspect that your rule is simply in the wrong place.

[CNibbana]

Hi Lucy,

Yes those were simply typos. A quick cut and paste job without making the corrections.

The 'cdn' subdomain points to the same root directory as the main domain (i.e. /htdocs) where the htaccess file is located so I'm not sure why it wouldn't work?

[lucy24]

You have no idea how much confusion that simple term "points to" can cause. Again, we're talking about physical location of the files, which may have no relation to what the outside user sees. If it's your own server you know exactly where everything is; if it's shared you know only where they tell you things are.

Simple test: make a rule that applies only to yourself. Easiest is to make a condition looking at REMOTE_ADDR and put in your own IP address. Then let the rule itself say something like

RewriteRule . /foobar.html [R=301,L]

using any made-up name for the redirect. Now put in a manual request for any page. You will get your custom 404 page, but the address bar will say example.com/foobar.html. Or pics.example.com/foobar.html or whatever (sub)domain you originally asked for.

If the test only works for example.com, then all those subdomains live somewhere else and you need to find them in order to include them in the htaccess. If it works with subdomains too, then we hammer out the real rule.

[tangor]

.