Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to develop a book reader online. The problem is that I save the pages as jpg or pdf and then I want to get the file using flash but I do not want this files as direct download, so I want to avoid download jpg and png but not js or swf. I tried to use this in my htaccess but does not work because does not allow to get the js files. Any error?

# secure htaccess file
<Files .htaccess>
order allow,deny
deny from all
Options All -Indexes
RewriteEngine On
#RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?server/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(js|swf)$ - [F]
<Files ~ "^.(htaccess|htpasswd)$">
deny from all
Options Indexes
order deny,allow
share|improve this question

migrated from Dec 7 '11 at 22:25

This question came from our site for professional and enthusiast programmers.

You can't do that if you want your swf to read them.

share|improve this answer
Is it impossible to deleiver by IP??? – José Carlos Dec 1 '11 at 18:25
you can use a socket, but its much more complex. – Daniel A. White Dec 1 '11 at 18:43

Any reason you can't use the same Files directive that denies access to the .htaccess and .htpasswd files to also deny access to jpg and png?

share|improve this answer
When you deny access to images, then also browsers won't be able to display them on the website – Enrico Pallazzo Dec 1 '11 at 18:30
I believe that was the whole point. He wants the Flash application to provide them instead. – Ioan Dec 1 '11 at 18:33
How will the Flash application download them if Apache won't serve them? – daiscog Dec 1 '11 at 18:50
Good point. I was thinking of Flash combined with a serverside app. It's possible to make a crude PHP/CGI script that will communicate with the Flash app only. – Ioan Dec 1 '11 at 21:18

The only real way to allow your flash application to get at some content and not let other user agents is to use a protocol other than HTTP. For example, if data security is important (just as an example), you could encrypt the data on the server and have the flash application decrypt it when it receives it.

The "protocol" doesn't need to be anything fancy. It could even be as simple as a base-64 encoding on the server-side that the flash-side decodes. The principal behind it though, of using something other than just http, is the only real way to protect it from generic browsers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.