I want to restrict access to a flash movie so it can only be loaded from a certain url. That url is a page on my server which can only be accessed after you get a pass code. What I don't want is someone who has a pass code scanning the page html source to find the flash movie url and publishing it so everybody can see the file.

Say the page is: http://www.mydomain.com/you_have_a_code.php and the flash movie is: http://www.mydomain.com/movies/movie.swf

I dont' really care if someone steals the flash movie from the cache and publishes it on another website, that's kind of impossible to avoid. What really bothers me is that someone publishes the second link and then people can access the flash movie indiscriminately, on my own server, without having a pass code.

Can that be achieved with the .htaccess file? how?


Try something like this. It requires mod_rewrite, of course.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://www\.mydomain\.com [NC]
RewriteRule ^movies/movie.swf$ - [F,L]

Also, try this community wiki: Redirect, Change URLs or Redirect HTTP to HTTPS in Apache - Everything You Ever Wanted to Know About Mod_Rewrite Rules but Were Afraid to Ask






  • 3
    You should be aware that the HTTP referrer can be arbitrarily forged and some corporate proxies filter it out anyway. – joschi Apr 28 '11 at 17:27
  • This will break if the user's browser doesn't send referrer headers, though. – Andrew Lambert Apr 28 '11 at 17:28
  • True that. Fixed with the extra RewriteCond, I think. – Eduardo Ivanec Apr 28 '11 at 17:30
  • The removal of headers still breaks this, of course. The only way I can think to avoid breaking those browsers/proxies is to keep a whitelist of IPs that have recently accessed other URLs. That isn't trivial though. – Eduardo Ivanec Apr 28 '11 at 17:33
  • Thks for the quick response! Works fine and, based on the references, I added a redirect to another content. So, if the browser is not sending the referrer (whether because a proxie ripped it off or because the browser is not sending it in the first place) what would hapen then? the user would see the flash movie? or will be redirected? If he sees the actual movie that's fine, because I don't want someone with a valid code not being able to see the movie because of his company proxie or browser configuration. – Pol Apr 28 '11 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.