Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not even sure if this is possible; I'm on an apache server. For the file located at:

http://www.example.com/dir/img.jpg
  • Allow this image to be loaded in a page called from that directory.
  • Disallow this image to be loaded directly; ie. the url above should not load
  • Prevent linking this image from a page located elsewhere

The purpose is the file should only be able to be displayed on the particular page its destined for; it should not be viewable directly. Can this be done?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

From the Apache documentation:

Blocked Inline-Images

Description: Assume we have under http://www.quux-corp.de/~quux/ some pages with inlined GIF graphics. These graphics are nice, so others directly incorporate them via hyperlinks to their pages. We don't like this practice because it adds useless traffic to our server.

Solution: While we cannot 100% protect the images from inclusion, we can at least restrict the cases where the browser sends a HTTP Referer header.

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://www.quux-corp.de/~quux/.*$ [NC]
RewriteRule .*\.gif$        -                                    [F]

RewriteCond %{HTTP_REFERER}         !^$
RewriteCond %{HTTP_REFERER}         !.*/foo-with-gif\.html$
RewriteRule ^inlined-in-foo\.gif$   -                        [F]
share|improve this answer
2  
Great example. There's no 100% solution, but this comes as close as it gets, as the referer header is not mandatory and would be easy to tweak, though not in situations mentioned in the question. +1 –  Olaf Feb 20 '10 at 8:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.