Dear Wiki user, You have subscribed to a wiki page or wiki category on "Httpd Wiki" for change notification.
The following page has been changed by noodl: http://wiki.apache.org/httpd/Rewrite/Common/ImageTheft The comment on the change is: >From rewrite.drbacchus.com New page: == Problem == The general idea here is that you want to prevent people from including your images in their webpages. This is termed "image theft" or "bandwidth theft" simply because they are using your resources for their website. The following rulesets will prevent that from happening, based on the HTTP_REFERER header. There are two main ways that you might wish to deal with this. You can either simply forbid the request, as the first recipe does, or you can redirect that request to some other resource, such as a "please go away" image, or perhaps something even less appealing, as you like. == Forbid the request == In this example, '''example.com''' should, of course, be replaced with your own website address. {{{ RewriteEngine on RewriteCond %{HTTP_REFERER} !="" RewriteCond %{HTTP_REFERER} !example\.com [NC] RewriteRule \.(jpe?g|gif|png)$ - [F,NC] }}} The result of this ruleset is that any requests that aren't referred by pages on '''example.com''' or '''something.example.com''' will generate a 403 Forbidden message, resulting in a broken image on the other end. Note that the referrer may also be blank, which allows for clients which do not pass a referrer for some reason. == Replace the request == {{{ RewriteEngine on RewriteCond %{HTTP_REFERER} !="" RewriteCond %{HTTP_REFERER} !example\.com [NC] # depending upon in which context you use the RewriteRule, # you might need a condition to exclude the go_away.png to prevent # an internal redirect looping. We don't use a RegEx here:: RewriteCond %{REQUEST_URI} !=/images/go_away.png RewriteRule \.(jpe?g|gif|png)$ /images/go_away.png [NC,L] }}} If you want the image to be replaced with a URL from another site, you can do so by providing a full URL in that !RewriteRule: {{{ RewriteRule \.(jpe?g|gif|png)$ http://other.example.com/images/go_away.png [R,NC,L] }}} == Discussion == The idea here is to only allow your own domains, and those you authorize, to be able to hot-link to your site's images. This may be extended to multiple approved hostnames by adding additional !RewriteCond directives (or modifying the regular expression) enumerating those hostnames. We also permit the HTTP_REFERER to be empty (="") so that if something is requested directly (by typing in a URL) or by a client that doesn't pass REFERER information (e.g. caused by some proxy cacheing machines, firewalls, privacy software) the request will still be permitted. If the !RewriteConds match (ie, the request is not one of the required values) the the request will instead be redirected to another page, explaining why image theft is a bad idea. You could alternately redirect to another image, or simply refuse the connection using the [F] or [R=403] (Apache 2.1 and later) flag.
