Other options to prevent Hotlinking

[bradgrafelman]

The first thing you should realize/acknowledge is this: preventing hotlinking is impossible. At least, it's impossible to do without generating false positives and denying legitimate requests. HTTP is a stateless protocol by design, and fields like the 'Referer' header are completely optional and may even be intentionally removed/filtered by intermediate gateways/proxies (or simply user configuration/preference).

If you're still determined to prevent hotlinking like this, then perhaps one possible suggestion might be to place each "skin/template" for each league in its own directory, and then use .htaccess files within those directories to allow the appropriate leagues.

[theeohiostate]

That is what i have tried , all skins/template have their own directory on my server but my server and the server i install them on are different , i can not find a way to get it done using htaccess

[bradgrafelman]

Can you show us an example of one of the .htaccess files you tried to use?

[theeohiostate]

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

This works fine but it allows hotlinking on the entire "30" server , when i try to isolate the url exactly , it doesn't work ex. http://football30.myfantasyleague.com/2012/options?L=43896&O=07

[bradgrafelman]

Can you show us what you tried when you tried to "isolate the url exactly" ? Did you remember to escape any characters that have special meaning in regular expressions?

Also, have you tried examining the 'Referer' header value for such requests to confirm it contains what you expect?

[theeohiostate]

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

This is what i have tried , it works for the homepage of the site , but since all the pages within the site have the unique LeagueID at the end of the URl i have to allow/deny them all , so when i add a full URL for example as above the "options?L=63454&O=07" page , it doesn't work on that page , i assume because of the charactors in the URL

[bradgrafelman]

theeohiostate;10998425 wrote:

i assume because of the charactors in the URL

One such character would be the question mark. Notice how it appears in "http(s)?:", yet you surely don't see URLs like "https?://mysite.com" ? Try escaping the question mark in the query string since you want a literal question mark in the regexp pattern there.

Likewise, note that the period denotes "any character", so "nitrografixx.com" inside a regexp pattern will match "nitrograffixxAcom" or "nitrograffixx!com" or... etc.

[theeohiostate]

Thanks, can you replace this with your corrections to make sure I'm following your advice correcting , noob here sorry

[theeohiostate]

Tried to remove the ? and did not work

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)://(www.)football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

[traq]

he didn't say "remove it," he said "escape it." The backslash ( \ ) is the escape character. So:

? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

[theeohiostate]

traq;10998433 wrote:

he didn't say "remove it," he said "escape it." The backslash ( \ ) is the escape character. So:

? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

Sorry that is so confusing to me , can you illustrate that for me so i can see using what i have

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?nitrografixx.com} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?www30.myfantasyleague.com/2012/home/63454} [NC]
RewriteCond %{HTTP_REFERER} !^{http(s)?://(www.)?football30.myfantasyleague.com/2012/options?L=63454&O=07} [NC]
RewriteRule .(jpg|jpeg|png|gif|css|js)$ - [NC,F,L]

[traq]

I did illustrate what I meant:

traq;10998433 wrote:

? means (in this case, anyway) "preceding character is optional," while \? means "?"

likewise,
. means "(almost) any character," while . means "."

If you want your pattern to match a question mark (?), write: \?

If you want your pattern to match a period (.), write: .

Give it a try and post again if you have any difficulties.

If you want me to do your work for you, you may contact me privately.

I am available for freelance work.