Forum Moderators: phranque
before christmas with time on my hands I'm trying to find a way to allow js and css files to be served to web pages but then stop people downloading the actual content.
I've tried a number of htaccess and rewritemap options but none have worked successfully.
The particular site I'm trying this on uses this to serve html pages.
RewriteEngine On
RewriteRule ^([a-zA-Z0-9_-]+)\.html$ toptemplate.php?page=$1 [L]
so that may complicate the issue and explain why RewriteMap didn't work.
I may well have come up with a solution which I will post here if anyone is interested. Which would then allow any logic flaws to be checked.
Jim
What about if access to the said CSS/JS files was restricted to the server-sided html file on localhost, that included the files via a script or link tag?
Direct access for downloading not from localhost could be denied. I'm not sure how though.
Jim
Are you trying to deny hotlinking to css/js files or are you trying to prevent browser caching of these files, or something else entirely?
it's a straightforward fact, if it gets served in a web page then you must be able to download it. But I started to wonder if there is a way to serve it to the page but stop people downloading it. This is not stopping hotlinking but actually stopping someone downloading it.
I've had some success today but it's still causing me some problems.
What I've got is two domains on the same server (they must be on the same server in case the server goes down).
Domain A has hardcoded into the header
<link rel="stylesheet" type="text/css" href="http://www.domainb.co.uk/downloads/#*$!x.css">
<script src="http://www.domainb.co.uk/downloads/menu.js" type="text/javascript"></script>
So domain A is getting the css and js files from domain B which works fine (both on the same server so no problem if the server goes down)
Then in domain B you put a htaccess file in the directory downloads which says something like this :-
Options -indexes
RewriteEngine on
RewriteCond %{HTTP_REFERER}!^http://(www\.)?domaina.co.uk/.*$ [NC]
RewriteRule \.(js¦css)$ - [F]
which only allows access from domain A thereby stopping someone typing in the link information from domain B.
It works although I am having some strange results sometimes, but I'm sure if there is a flaw in my logic the people in this forum will find it out.
If the CSS or JS is to affect the client browser, then in fact, it is already 'downloaded', and available in the client's cache. It has to be, since CSS and JS are processed by the client, not the server. So, it's a simple matter to save it to disk.
The server 'cannot tell' any difference between a 'view' and a 'download' request, unless you do client-state tracking on the session using cookies and a script to manage the current state of the visitor's session. Simple referrer-based access control is incapable of reliably handling this problem.
If you have CSS that's so cool or JS that is so clever that you don't want it copied, then the only foolproof solution is to take it off the Web, or retain an attorney to actively enforce your copyright under the DMCA. Referrer-based access control simply won't be sufficient. We've obviously failed to convince you of this fact, but a search of WebmasterWorld for 'stop download' or 'hotlinking' or 'referrer unreliable' will turn up hundreds of threads, all with the same conclusion... Sorry.
Jim
It's purely a hypothetical problem, this would be far too much work in the normal scheme of things, although I can see people who constantly have their sites ripped being interested.
If there is no viable solution then that's that, but in a search of this forum I did not discover a thread that contained this idea.
The http referer is possibly the sticking point, but are there other ways to reference the site (ip for instance).
People on this site have much more understanding of Apache than I do so someone may be inspired.
