up vote 1 down vote favorite
share [g+] share [fb]

I'm trying to develop a book reader online. The problem is that I save the pages as jpg or pdf and then I want to get the file using flash but I do not want this files as direct download, so I want to avoid download jpg and png but not js or swf. I tried to use this in my htaccess but does not work because does not allow to get the js files. Any error?

# secure htaccess file
<Files .htaccess>
order allow,deny
deny from all
</Files>
Options All -Indexes
RewriteEngine On
#RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?server/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(js|swf)$ - [F]
<Files ~ "^.(htaccess|htpasswd)$">
deny from all
</Files>
Options Indexes
order deny,allow
link|improve this question
feedback

migrated from stackoverflow.com Dec 7 '11 at 22:25

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 0 down vote

You can't do that if you want your swf to read them.

link|improve this answer
Is it impossible to deleiver by IP??? – José Carlos Dec 1 '11 at 18:25
you can use a socket, but its much more complex. – Daniel A. White Dec 1 '11 at 18:43
feedback
up vote 0 down vote

Any reason you can't use the same Files directive that denies access to the .htaccess and .htpasswd files to also deny access to jpg and png?

link|improve this answer
When you deny access to images, then also browsers won't be able to display them on the website – Mr. Pallazzo Dec 1 '11 at 18:30
I believe that was the whole point. He wants the Flash application to provide them instead. – Ioan Dec 1 '11 at 18:33
How will the Flash application download them if Apache won't serve them? – user91367 Dec 1 '11 at 18:50
Good point. I was thinking of Flash combined with a serverside app. It's possible to make a crude PHP/CGI script that will communicate with the Flash app only. – Ioan Dec 1 '11 at 21:18
feedback
up vote 0 down vote

The only real way to allow your flash application to get at some content and not let other user agents is to use a protocol other than HTTP. For example, if data security is important (just as an example), you could encrypt the data on the server and have the flash application decrypt it when it receives it.

The "protocol" doesn't need to be anything fancy. It could even be as simple as a base-64 encoding on the server-side that the flash-side decodes. The principal behind it though, of using something other than just http, is the only real way to protect it from generic browsers.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard