Home / server / Questions / 437286
Accepted
Jeff
Asked: 2012-10-12 05:29:32 +0800 CST

How to enable hotlink protection without hardcoding my domain in the Apache config file?

  • 772

Been surfing around for a solution for a couple days now.

How do I enable Apache hotlink protection without hardcoding my domain in the config file so I can port the code to my other domains without having to update the config file every time?

This is what I have so far:

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?example\.(com|net|org) [NC]
RewriteRule \.(gif|ico|jpe|jpeg|jpg|png)$ - [NC,F,L]

... And this is what Apache suggests:

SetEnvIf Referer example\.com localreferer
<FilesMatch \.(jpg|png|gif)$>
    Order deny,allow
    Deny from all
    Allow from env=localreferer
</FilesMatch>

... both of which hardcode the domain in their rules.

The closest I came to finding any info that covers this is right here on ServerFault, but the conclusion was that it cannot be done. Based on my research, that appears to be true, but I didn't find any questions or commentary dedicated soley to this question.

If anyone's curious, here is the link to the Apache 2 docs that cover this topic.

Note that Apache environment variables (e.g. %{HTTP_REFERER}) cannot be used in the RewriteCond's CondPattern argument.

apache-2.2

1 Answers

  1. Best Answer

    What about checking to see if Host matches the Referrer? E.g.

    RewriteCond %{HTTP_REFERER} !%{HTTP_HOST}

    Edit

    This won't work, as stated by the OP. For Apache 2.4 you can use:

    RewriteCond expr "! %{HTTP_REFERER} -strmatch '*://%{HTTP_HOST}/*'"

    For 2.2, you could write a small handler in mod_perl or mod_python that could perform the compare and issue the 403 error.

    To achieve this with mod_python:

    Create a file in your docroot (in my case /var/www/) called hotlink.py

    from mod_python import apache

def headerparserhandler(req):
    if req.headers_in.get("Host") != req.headers_in.get("Referer"):
            return apache.HTTP_FORBIDDEN
    return apache.OK

    In you Apache config:

     <Directory /var/www/>
   ...
   AddHandler mod_python .jpg
   AddHandler mod_python .gif
   PythonHeaderParserHandler /var/www/hotlink.py
   #PythonDebug On
 </Directory>

    Now all requests for .jpg and .gif will be first checked by hotlink.py. With mod_python you can also check against the req.server.server_hostname attribute to check against ServerName instead of the incoming Host header.

    • 2