Apache permissions help

[grassmonk]

Hey all,

I'm somewhat of an Apache newbie. I'm trying to have some files (mp3, wmv, etc) on one server that can only be accessed by my other server. Specifically, I'm trying to embed the files in some HTML code and be able to click a download link from the page to be able to grab the file. I have a Directory directive set up with an Allow From, but as I understand it the Allow From checks the end user's IP address, not the server's IP. Is there a way to only allow access to a certain directory from my server's IP?

Thanks in advance.

[sitz]

Your understanding of the 'Allow' directive is correct. However...

Is there a way to only allow access to a certain directory from my server's IP?

...doesn't mean much (for precisely the same reason). The server isn't making a request of the embedded object, the client is. Now, when a request is made for an image (or movie, or what have you), the Referer header is (generally) sent by the browser to inform the server what page contained the link just clicked. Armed with this, one can create a mod_rewrite rule which will do what you want. The forum archives have copious amounts of information on this; search for 'mod_rewrite' and 'referer'.

Hope this helps.

[grassmonk]

Thanks for the info. I found a similar solution using the referer; my concern is that browsers don't always send the referer. I'll have to do some more checking to see what I can do about that.

[sitz]

Correct; browsers are not obligated to send a referer, nor is the referer guaranteed to be accurate. The major problem with implementing Referer-based ACLs is that you're granting/denying access based soley on a single piece of unauthenticated user-supplied data. It'll catch the low-hanging fruit (read: users who don't know better), but if someone knows what they're doing, bypassing such restrictions is trivial.