.htaccess and mod_rewrite

[nix]

Hi all, I have a site that has MP3's on it, and I find that other sites are linking to them directly. I'd much rather have them only have access via my site. I've been doing some reading, and I know this can be done by hotlink protection with mod_rewrite, but I'm not sure how I should go about this. I tried once, and internal server errors shut down my site, so it's time for me to ask someone. What I'm trying to do is check the referrer and make sure it's only from the one site, then only block mp3's, wav's and wmv's by redirecting them to my homepage. What I typed was:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://www.somesite.net$ [OR, NC]
RewriteCond %{HTTP_REFERER} !^http://www.somesite.com$ [OR, NC]
RewriteCond %{HTTP_REFERER} !^http://somesite.net$ [OR, NC]
RewriteCond %{HTTP_REFERER} !^http://somesite.com$ [OR, NC]
RewriteRule .*\.(mp3|wmv|wav)$ http://www.somesite.net [L, R]

I can grasp what I did, but I was sort of hoping that there was an if statement with clear boundaries. No such luck with this I guess. What I managed to do with this was make sure that no pages outside my homepage worked. The reason I have 4 different site URLs is that I have a .net main site, and a .com redirect to the .net. Then I check to make sure that if they didn't include the w3, that they still wouldn't have access from outside. This is after a half hour of reading code examples, but not totally understanding. Any help would be more appreciated. I have a major leech on my hands.

[darksidepuffin]

I'm not sure I understand your question, Nix...What your doing with that code is the equivilant to this in human language:

if the HTTP_REFERER does NOT equal http://www.somesite.net,http://www.somesite.com,http://somesite.net,http://somesite.com

AND the file requested is a mp3, wmv, or wav

redirect to http://www.somesite.net.

If you could explain your question, I might be able to help a bit more.

[nix]

Yes, that's exactly it. How would I go about doing that? I'm going over the documentation for it right now, but again, this thing that I'm doing doesn't seem to be written in stone anywhere where I can just glean the information. A thorough understanding seems to be in order. :)

[darksidepuffin]

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://somesite.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://somesite.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://somesite.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://somesite.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.somesite.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.somesite.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.somesite.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.somesite.net$ [NC]
RewriteRule .*\.(mp3|wav|wmv)$ http://www.somesite.com [R,NC]


the /.* in the pattern checks for "a slash and any number of other characters" (eg: a filename) -- the way you had it before only matched if the domain was the only part of the referrer.

[nix]

You sir have hit it right on the nose. It works flawlessly for now. Is there any way to perhaps check for Media agents? Such as Windows media player and Winamp Player? I can still access the URL's via those mediums, but I'm not worried about people leeching that way. But for future reference.

[darksidepuffin]

To be completely and entirely honest, I don't know. I've never worked with media agents so I don't know what they do identification wise.

[nix]

I've run into a problem. With Opera and Firefox, I can right click and "save target as" which is a good thing. But when I go into IE and right click to save target as, it downloads the index page instead of the mp3 because that's what the .htaccess is redirecting to. I believe this is happening because Internet Explorer is using some sort of ActiveX localhost method of downloading and the .htaccess doesn't allow that. I tried adding this to the htaccess and it didn't work either.

RewriteCond %{HTTP_REFERER} !^localhost$ [NC]
RewriteCond %{HTTP_REFERER} !^http://127.0.0.1/$ [NC]

Am I doing something wrong?

[NerdLib]

You sir have hit it right on the nose. It works flawlessly for now. Is there any way to perhaps check for Media agents? Such as Windows media player and Winamp Player? I can still access the URL's via those mediums, but I'm not worried about people leeching that way. But for future reference.


Why not do the same thing but check for HTTP_USER_AGENT instead?

[afterburn]

cause a user agent is not the same, the user agenet doesn't tell you that they have winamp or media player installed. it just tells you the browser and maybe the vendor.

[NerdLib]

True.. I was just saying that if they attempted to open it with media player and used OPEN URL the user agent would be Media Player and not IE.