Other options to prevent Hotlinking

theeohiostate

I have tried the .htaccess to prevent hotlinking but due to how the particular website that I am trying to work with, it doesn't seem possible. The only option I can think of is being able to embed some code in a header message of the website that will work in conjunction with a php/script in the directory of my server that will permit that site to hotlink my css and images.

I do custom skins/templates for clients of a fantasy football website called myfantasyleague.com , which hosts 1000's of leagues on over 40 servers. Each servers name is in the url along with a unique league id. When using the .htaccess rewrite code, I can only allow/deny an entire server, instead of certain leagues within that server. Examples of some of the URL's are as follows.

http://www30.myfantasyleague.com/2012/home/43896
http://football30.myfantasyleague.com/2012/options?L=43896&O=07
http://www9.myfantasyleague.com/2011/home/63845
http://football6.myfantasyleague.com/2012/standings?L=40042

You can see the different servers noted by 30,9,6 and the league id's which all come at the end of each URL

I do have access to the header message of each league i customize, so that is my thought process. I've tried everything I know using a .htaccess file placed in the directory on my server to only allow a specific league, but it doesn't work. You can see using anyone of the links about, their source code uses a script to place the league ID for each league in the URL

So, question is....is there anything I can do here?

bradgrafelman

The first thing you should realize/acknowledge is this: preventing hotlinking is impossible. At least, it's impossible to do without generating false positives and denying legitimate requests. HTTP is a stateless protocol by design, and fields like the 'Referer' header are completely optional and may even be intentionally removed/filtered by intermediate gateways/proxies (or simply user configuration/preference).

If you're still determined to prevent hotlinking like this, then perhaps one possible suggestion might be to place each "skin/template" for each league in its own directory, and then use .htaccess files within those directories to allow the appropriate leagues.

theeohiostate

That is what i have tried , all skins/template have their own directory on my server but my server and the server i install them on are different , i can not find a way to get it done using htaccess

bradgrafelman

Can you show us an example of one of the .htaccess files you tried to use?

theeohiostate

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

This works fine but it allows hotlinking on the entire "30" server , when i try to isolate the url exactly , it doesn't work ex. http://football30.myfantasyleague.com/2012/options?L=43896&O=07

bradgrafelman

Can you show us what you tried when you tried to "isolate the url exactly" ? Did you remember to escape any characters that have special meaning in regular expressions?

Also, have you tried examining the 'Referer' header value for such requests to confirm it contains what you expect?

theeohiostate

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

This is what i have tried , it works for the homepage of the site , but since all the pages within the site have the unique LeagueID at the end of the URl i have to allow/deny them all , so when i add a full URL for example as above the "options?L=63454&O=07" page , it doesn't work on that page , i assume because of the charactors in the URL

bradgrafelman

theeohiostate;10998425 wrote:
i assume because of the charactors in the URL

One such character would be the question mark. Notice how it appears in "http(s)?:", yet you surely don't see URLs like "https?://mysite.com" ? Try escaping the question mark in the query string since you want a literal question mark in the regexp pattern there.

Likewise, note that the period denotes "any character", so "nitrografixx.com" inside a regexp pattern will match "nitrograffixxAcom" or "nitrograffixx!com" or... etc.

theeohiostate

Thanks, can you replace this with your corrections to make sure I'm following your advice correcting , noob here sorry

theeohiostate

Tried to remove the ? and did not work

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

traq

he didn't say "remove it," he said "escape it." The backslash ( \ ) is the escape character. So:

? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

theeohiostate

traq;10998433 wrote:
he didn't say "remove it," he said "escape it." The backslash ( \ ) is the escape character. So:

? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

Sorry that is so confusing to me , can you illustrate that for me so i can see using what i have

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

traq

I did illustrate what I meant:

traq;10998433 wrote:
? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

If you want your pattern to match a question mark (?), write: \?

If you want your pattern to match a period (.), write: .

Give it a try and post again if you have any difficulties.

If you want me to do your work for you, you may contact me privately.

I am available for freelance work.