Is there anyway to stop people from hotlingking flash files? - GoFuckYourself.com

Phil · 10-18-2008, 08:09 PM

I got hijacked by chinese leachers. need help asap..

IllTestYourGirls · 10-18-2008, 08:11 PM

just flash?

Tempest · 10-18-2008, 08:13 PM

setup some streaming instead... simple php streaming can do the trick for most hotlinking.

Phil · 10-18-2008, 08:14 PM

Quote:

Originally Posted by IllTestYourGirls

just flash?

yes, flash videos.

10-18-2008, 08:17 PM

Can't you have your host block the requesting referrers?

sfera · 10-18-2008, 08:21 PM

make your site the only referral. also would block chinese ips.

Phil · 10-18-2008, 08:23 PM

Quote:

Originally Posted by sfera

make your site the only referral. also would block chinese ips.

is there any way to block any hotlinking of all flash files, not just chinese?

boneprone · 10-18-2008, 08:30 PM

YEah there is. We had the same issue. Our host did something about it. Like a htaccess kinda thing

Phil21 · 10-18-2008, 08:42 PM

You can use referral blocking (mod_rewrite type of stuff) and it's generally "good enough" for a casual deterrent.

However, many browsers do *not* send a refferer header string for flash movie content, thus you cannot truly rely on it. Most sites won't bother hotlinking though, when 30-60% or whatever traffic doesn't get a good pageload.

The best way to do it is via secure download tokens, like lighttpd's mod_securedownload and about 5,000 others. Basically, you have your PHP code generate a link to the movie with a hash, using a shared secret. Your webserver then checks to ensure that this hash is valid prior to serving the file in question.

If both the PHP and the static files (.flv) are hosted on the same webserver instance, you can use a myriad of off-the-shelf anti-hotlink products. Nearly anything on the market.

If they are hosted elsewhere, most products will no longer work - and you'll want something like the hash sharing mechanism outlined above.

As for PHP "streaming" - yeah, if you want to do about 1/100th of what the server can actually push, sure

Running static files through PHP is a horrible idea, unless you simply don't have enough traffic for it to matter and it's the easiest solution for your particular developers.

Regards,

-Phil

Voodoo · 10-18-2008, 09:02 PM

Try this:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yoursite.com(/)?.*$ [NC]
RewriteRule .*.(jpg|flv)$ - [NC,F]

Found it on Google, I haven't tested it though.

Naughty-Pages · 10-18-2008, 09:06 PM

Quote:

Originally Posted by Voodoo

Try this:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yoursite.com(/)?.*$ [NC]
RewriteRule .*.(jpg|flv)$ - [NC,F]

Found it on Google, I haven't tested it though.

yup.. although that includes jpg's..

i use a similar code on all of our servers for mainly jpg's and gif.. to keep bandwidth down..

fujiko · 10-18-2008, 10:51 PM

Quote:

Originally Posted by Voodoo

Try this:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yoursite.com(/)?.*$ [NC]
RewriteRule .*.(jpg|flv)$ - [NC,F]

this code doesnt protect flv hotlinking on firefox... ive tried it.

boneprone · 10-18-2008, 11:26 PM

Listen to Phil21..

He's the one who PERSONALLY helped me and fixed our problem.

papill0n · 10-19-2008, 01:28 AM

Quote:

Originally Posted by Phil21

You can use referral blocking (mod_rewrite type of stuff) and it's generally "good enough" for a casual deterrent.

However, many browsers do *not* send a refferer header string for flash movie content, thus you cannot truly rely on it. Most sites won't bother hotlinking though, when 30-60% or whatever traffic doesn't get a good pageload.

The best way to do it is via secure download tokens, like lighttpd's mod_securedownload and about 5,000 others. Basically, you have your PHP code generate a link to the movie with a hash, using a shared secret. Your webserver then checks to ensure that this hash is valid prior to serving the file in question.

If both the PHP and the static files (.flv) are hosted on the same webserver instance, you can use a myriad of off-the-shelf anti-hotlink products. Nearly anything on the market.

If they are hosted elsewhere, most products will no longer work - and you'll want something like the hash sharing mechanism outlined above.

As for PHP "streaming" - yeah, if you want to do about 1/100th of what the server can actually push, sure

Running static files through PHP is a horrible idea, unless you simply don't have enough traffic for it to matter and it's the easiest solution for your particular developers.

Regards,

-Phil

Great post Phil

NY Jester · 10-19-2008, 03:22 AM

i was thiking htaccess but Phil21 seems to have a better way for sure.

Naughty-Pages · 10-19-2008, 09:04 AM

Quote:

Originally Posted by fujiko

this code doesnt protect flv hotlinking on firefox... ive tried it.

this has nothing to do with firefox LOL.. this is related to the server

(FYI: the yoursite.com is the site(s) you will allow to hotlink)

(instead of using it in htaccess i use it in a separate server-wide rules file..)

james_clickmemedia · 10-19-2008, 09:17 AM

Quote:

Originally Posted by Phil21

You can use referral blocking (mod_rewrite type of stuff) and it's generally "good enough" for a casual deterrent.

However, many browsers do *not* send a refferer header string for flash movie content, thus you cannot truly rely on it. Most sites won't bother hotlinking though, when 30-60% or whatever traffic doesn't get a good pageload.

The best way to do it is via secure download tokens, like lighttpd's mod_securedownload and about 5,000 others. Basically, you have your PHP code generate a link to the movie with a hash, using a shared secret. Your webserver then checks to ensure that this hash is valid prior to serving the file in question.

If both the PHP and the static files (.flv) are hosted on the same webserver instance, you can use a myriad of off-the-shelf anti-hotlink products. Nearly anything on the market.

If they are hosted elsewhere, most products will no longer work - and you'll want something like the hash sharing mechanism outlined above.

As for PHP "streaming" - yeah, if you want to do about 1/100th of what the server can actually push, sure

Running static files through PHP is a horrible idea, unless you simply don't have enough traffic for it to matter and it's the easiest solution for your particular developers.

Regards,

-Phil

Exactly what we have been using for years. Something about sessions is all I remember when our programmers explained it.

10-18-2008, 08:09 PM	#1
Phil Confirmed User Join Date: Jan 2004 Posts: 7,659	Is there anyway to stop people from hotlingking flash files? I got hijacked by chinese leachers. need help asap.. __________________ Ask Phil

10-18-2008, 08:11 PM	#2
IllTestYourGirls Ah My Balls Industry Role: Join Date: Feb 2007 Location: Under the gold leaf ICQ 388-454-421 Posts: 14,311	just flash? __________________

10-18-2008, 08:30 PM	#8
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	YEah there is. We had the same issue. Our host did something about it. Like a htaccess kinda thing __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

10-18-2008, 08:42 PM	#9
Phil21 Confirmed User Join Date: May 2001 Location: ICQ: 25285313 Posts: 993	You can use referral blocking (mod_rewrite type of stuff) and it's generally "good enough" for a casual deterrent. However, many browsers do not send a refferer header string for flash movie content, thus you cannot truly rely on it. Most sites won't bother hotlinking though, when 30-60% or whatever traffic doesn't get a good pageload. The best way to do it is via secure download tokens, like lighttpd's mod_securedownload and about 5,000 others. Basically, you have your PHP code generate a link to the movie with a hash, using a shared secret. Your webserver then checks to ensure that this hash is valid prior to serving the file in question. If both the PHP and the static files (.flv) are hosted on the same webserver instance, you can use a myriad of off-the-shelf anti-hotlink products. Nearly anything on the market. If they are hosted elsewhere, most products will no longer work - and you'll want something like the hash sharing mechanism outlined above. As for PHP "streaming" - yeah, if you want to do about 1/100th of what the server can actually push, sure Running static files through PHP is a horrible idea, unless you simply don't have enough traffic for it to matter and it's the easiest solution for your particular developers. Regards, -Phil __________________ Quality affordable hosting.

10-18-2008, 09:02 PM	#10
Voodoo ♥ ♦ ♣ ♠ Industry Role: Join Date: Sep 2002 Location: Porn Valley, CA Posts: 10,590	Try this: Code: RewriteEngine On RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !^http://(www\.)?yoursite.com(/)?.$ [NC] RewriteRule ..(jpg\|flv)$ - [NC,F] Found it on Google, I haven't tested it though. __________________ "I'm selflessly supporting the common good, but only coincidentally looking out for No.1." Last edited by Voodoo; 10-18-2008 at 09:03 PM..

10-18-2008, 08:13 PM	#3
Tempest Too lazy to set a custom title Industry Role: Join Date: May 2004 Location: West Coast, Canada. Posts: 10,217	setup some streaming instead... simple php streaming can do the trick for most hotlinking.

10-18-2008, 08:17 PM	#5
X37375787 Guest Posts: n/a	Can't you have your host block the requesting referrers?

10-18-2008, 08:21 PM	#6
sfera Confirmed User Join Date: Aug 2005 Location: ICQ: 248877409 Posts: 8,597	make your site the only referral. also would block chinese ips.

10-18-2008, 11:26 PM	#13
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	Listen to Phil21.. He's the one who PERSONALLY helped me and fixed our problem. __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

10-19-2008, 03:22 AM	#15
NY Jester Confirmed User Join Date: Nov 2007 Location: New York State Posts: 1,347	i was thiking htaccess but Phil21 seems to have a better way for sure. __________________ Jester X Web Services ICQ: 147 079 406 MadCatLinks.com