1

I'm trying to develop a book reader online. The problem is that I save the pages as jpg or pdf and then I want to get the file using flash but I do not want this files as direct download, so I want to avoid download jpg and png but not js or swf. I tried to use this in my htaccess but does not work because does not allow to get the js files. Any error?

# secure htaccess file
<Files .htaccess>
order allow,deny
deny from all
</Files>
Options All -Indexes
RewriteEngine On
#RewriteCond %{HTTP_REFERER} !^http://(.+\.)?domain\.com/ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.+\.)?server/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(js|swf)$ - [F]
<Files ~ "^.(htaccess|htpasswd)$">
deny from all
</Files>
Options Indexes
order deny,allow
Improve this question

3 Answers 3

Reset to default
0

You can't do that if you want your swf to read them.

Improve this answer
2
  • Is it impossible to deleiver by IP???
    – José Carlos
    Dec 1, 2011 at 18:25
  • you can use a socket, but its much more complex.
    – Daniel A. White
    Dec 1, 2011 at 18:43
0

Any reason you can't use the same Files directive that denies access to the .htaccess and .htpasswd files to also deny access to jpg and png?

Improve this answer
4
  • When you deny access to images, then also browsers won't be able to display them on the website
    – Wouter Dorgelo
    Dec 1, 2011 at 18:30
  • I believe that was the whole point. He wants the Flash application to provide them instead.
    – Ioan
    Dec 1, 2011 at 18:33
  • How will the Flash application download them if Apache won't serve them?
    – daiscog
    Dec 1, 2011 at 18:50
  • Good point. I was thinking of Flash combined with a serverside app. It's possible to make a crude PHP/CGI script that will communicate with the Flash app only.
    – Ioan
    Dec 1, 2011 at 21:18
0

The only real way to allow your flash application to get at some content and not let other user agents is to use a protocol other than HTTP. For example, if data security is important (just as an example), you could encrypt the data on the server and have the flash application decrypt it when it receives it.

The "protocol" doesn't need to be anything fancy. It could even be as simple as a base-64 encoding on the server-side that the flash-side decodes. The principal behind it though, of using something other than just http, is the only real way to protect it from generic browsers.

Improve this answer

You must log in to answer this question.