Securing Apache directories allowing access only through links on the server

Question

I have an HTML page (on a server running Apache) that basically contains a bunch of links (link menu) to other HTML/PHP pages in VirtualDirectories on the same server. Is there a way to only allow access to the URLs specified in links on the "main page" by clicking on those links and not by book marking or issuing the URLs directly from the browser by using some Apache directives and/or PHP? Would I have to pass some sort of token via a POST from the "menu page" and check to see if that token has a valid value from the linked "applications"?

Hopefully the question makes sense.

Answer 1

Use PHP's server variable $_SERVER['HTTP_REFERER'] to see which page they came from. If it isn't the page you have the links on, deny them access.

Keep in mind that this is the most simple of solutions, and should not be implemented if you are heavily concerned about security. The referrer can easily be spoofed.

Answer 2

You can do the same with a mod_rewrite in apache itself.

Answer 3

Oops on the double post.

http://www.widexl.com/tutorials/mod_rewrite.html#anti_leach

Lots of people use mod_rewrite to stop people from hot linking images. The above shows one example. I bet the above example can be tweaked to do what you are looking for.