Forum Moderators: coopster

Message Too Old, No Replies

Preventing hotlinking to pdf files

can this method be translated from asp.net to php?

         

Mokita

12:16 pm on Mar 7, 2006 (gmt 0)

10+ Year Member



I found this method via Google, but our site is hosted on Apache not windoze. We have approx one hundred pdfs, some are 9-10mb each. So hotlinking is problematic.

I'm unable to implement the normal .htaccess method used for images, because frequently legitimate downloaders requesting the files from within our site, do not provide an http referer for pdfs.

Is there an equivalent method in php? I searched but couldn't find anything.

I'm assuming you're running ASP.NET; if you're not, then hopefully these suggestions will translate to whatever development environment you're using.

Let's say your server is hosting your web site "http://superwebsite" in the virtual folder "C:\Inetpub\wwwroot\superwebsite". You could store your docs in "C:\superwebsite\Docs". There is no way to navigate to that folder, and there is no direct URL that references that folder.

So, now no-one can get at these documents directly, but you want authentic visitors to your site to get at them. Instead of using hyperlinks (or whatever control that generates the <a href...> thingy ), place a button on your web page.

In the click event for the button, do something like this:

// Read the file into a buffer
string sf = @"C:\superwebsite\Docs\supermanual.pdf";
FileStream fs = new FileStream(sf, FileMode.Open, FileAccess.Read);
BinaryReader br = new BinaryReader(fs);

byte[] df = binReader.ReadBytes((int)fs.Length);

br.Close();
fs.Close();

// Transmit the buffer in the response
Response.Expires = 0;
Response.Buffer = true;
Response.ClearContent();
Response.ClearHeaders();
Response.ContentType = "application/pdf";
Response.BinaryWrite( df );
Response.Flush();
Response.End();

That's it. When your visitors click the button, the server responds with the requested document.

Creating the directory below the web root is no problem - I placed it here: /home/username/pdf/
However, I don't know how to program using php, so any assistance with the code would be very welcome.

omoutop

1:01 pm on Mar 7, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



cant help you with asp, but a nice way to prevetn hotlinking is with htaccess (site in apache).

A good article is this [devpapers.com...] Also u may want to ask for extra help here in [webmasterworld.com...]

Mokita

1:22 pm on Mar 7, 2006 (gmt 0)

10+ Year Member



Thank you for your reply.

Unfortunately, as I mentioned in my original post, the .htaccess method that works for hotlinked images does not work with PDF files.

That method relies on there being a referer string from our site or a blank referer (necessary because some ISPs like AOL don't send referers). Most downloads initiated from within our site, happen with no referer string sent, which is identical to what happens when someone downloads a pdf via a link from a remote site.

That is why I need a different method.

jatar_k

4:51 pm on Mar 7, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



you could also move them outside the web accessable portion of your site and only use a php script to serve them. Then you could do some kind of authentication before serving them

Mokita

3:07 am on Mar 8, 2006 (gmt 0)

10+ Year Member



Thank you for your reply jatar_k. As mentioned at the bottom of my first message, I have already created a folder outside the web accessable portion of the site.

Path to the web: /home/username/public_html/
Path to new pdf directory:/home/username/pdf/

However, I do not have a php script to serve them or have even the vaguest idea how to do authentication. That was the purpose of my original request. I'd really appreciate some assistance to locate suitable scripts and some basic instructions for a php newbie who is floundering badly.

TIA.

jatar_k

4:26 pm on Mar 8, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



sorry Mokita,

I did actually read your post, I know that's hard to imagine, but seemed to have glazed right over the last 2 important lines.

are these pdf downloaded by just anyone or do they have to login or make a purchase to download?

Mokita

1:04 am on Mar 9, 2006 (gmt 0)

10+ Year Member



The pdfs need to be available to any genuine visitor to the site. No purchase or login involved.

jatar_k

11:32 pm on Mar 9, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



I guess you could check referer

I wonder if there might be a rewrite fix for this

Mokita

12:16 am on Mar 10, 2006 (gmt 0)

10+ Year Member



I guess you could check referer

See message 3 above.

jatar_k

1:04 am on Mar 10, 2006 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



I am honestly losing my mind in this thread continually

that does put you in a tough spot

maybe set a cookie on your site and only allow those with the cookie to download, this would require a script to do so

I don't know of any scripts that do pdf protection, have you looked through any of the ebook protection type scripts? Those are usually pdf's

as far as a php dowmload script this search [google.com] shows a bunch of threads, though the problem is with that you need to find a way to auth these folk.

maybe a cookie is the way to go