IIS 7 URL Rewriting Rule for images not referred by the website itself

Question

New to URL rewriting with IIS 7. I need to redirect to another page for images not referred by the website itself. For example is someone enters "www.somesite.com/images/image001.jpg" into their browser it'll redirect the user to "www.somesite.com/prevent.aspx?image001.jpg".

I found a few good tips for preventing hotlinking here: http://blogs.iis.net/ruslany/archive/2009/04/08/10-url-rewriting-tips-and-tricks.aspx, which works great, but nothing like what I want from the above example.

Rewrite rule for preventing hotlinking:

<rule name="Prevent image hotlinking">
  <match url=".*\.(gif|jpg|png)$"/>
  <conditions>
    <add input="{HTTP_REFERER}" pattern="^$" negate="true" />
    <add input="{HTTP_REFERER}" pattern="^http://ruslany\.net/.*$" negate="true" />
  </conditions>
  <action type="Rewrite" url="/images/say_no_to_hotlinking.jpg" />
</rule>

Rewrite Rule for Redirection:

<rule name="Query String Rewrite">
  <match url="page\.asp$" />
  <conditions>
    <add input="{QUERY_STRING}" pattern="p1=(\d+)" />
    <add input="##{C:1}##_{QUERY_STRING}" pattern="##([^#]+)##_.*p2=(\d+)" />
  </conditions>
  <action type="rewrite" url="newpage.aspx?param1={C:1}&amp;amp;param2={C:2}" appendQueryString="false"/>
</rule>

Anyway to somehow combine the rules to do what I want?

Thanks in advance

Answer 1

If you want to stop hot linking and want to inform the user about it you typically want to send a dummy image back with a text saying that hot linking is not allowed. Redirecting the request to a page that says so does not help as it will most likely not be visible to the user.

Images are loaded with the <img> tag and although the browser will follow redirects, it will always expect to receive some kind of supported image. If the request is redirected to a HTML page the browser will simply not display the image or display an icon that an invalid image was received. The page from which the image was hot linked is still displayed though.

So the rewrite rule suggested by Ruslan Yakushev is actually the proper way to handle it. You could also respond with a redirect with e.g. the following action:

<action type="Redirect" url="http://www.somesite.com/prevent.aspx?{REQUEST_FILENAME}" appendQueryString="false" redirectType="Found" />

But the end result will be the same. You will not be able to redirect the main browser window to a different page though.