Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does one prevent hotlinking of swf files from an Amazon S3 file system? Flash files don't send http referrers, so I've tried to set a bucket policy that restricts to certain referrers at Amazon, but no luck.

And this typical anti-hotlinking .htaccess at my server doesn't work:

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)? [NC]
RewriteRule \.(jpg|jpeg|png|gif|swf)$ [NC,R,L]

.htaccess and mod_rewrite does work OK for other things, like WordPress permalinks, so I don't think it's a shared hosting-wide problem with mod_rewrite.

Does the URL I'm using in the flash embed matter?:

share|improve this question
Just emailed support about it, thanks. – markratledge Aug 12 '10 at 23:05
Have you ever received any response to this? – jayarjo Aug 14 '12 at 13:26
@jayarjo: I never did. I ended up using a Wordpress plugin to secure the files and set access permissions at amazon. – markratledge Aug 14 '12 at 17:05

The best way to do this is on your page have the code generate an S3 pre-signed URL that has a short lifetime. If, for example, the object is always downloaded in <60 seconds you can generate a signed URL that is valid for 60 seconds. The user can't reuse that same URL after 60 seconds is up. They would no longer be able to embed that object on their page as each request is only valid for 60 seconds.

You can read more about signed URLs here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.