Web Development

Ask something
Question Locked

How do you prevent access via a direct URL?

0 helpful
21 replies

by tink!

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are going to make PDF files available to clients that login to our website.

My question is, how do I prevent anyone from accessing the PDF by typing the direct url? (i.e. http://companysite.com/File.pdf)

I am using ASP pages and simple ASP codes to do the login and validation on webpages.

Our site is on AT&T Shared Hosting for Windows which provides very limited editability to the .htaccess file.

I think I can do redirects and some simple rewrites, but am not familiar with the rewrite coding needed for displaying a different URL.

Any suggestions are greatly appreciated!

Tink :)

[PS. What is with the huge font in the posting box? LOL.]

21 replies

by ---tk---

to a FTP site that requires a login and password.

by tink!

I'm learning this stuff as I go, and the .htaccess code is a little weird to read.

What would be the code to redirect anyone typing in the address:

http://www.companysite.com/pdfs/files/File.pdf

where File.pdf would have to have wildcards to include any pdf name.

by ic-it

isn't there a simple way to check for a redirection source and then deny if it wasn't from your company site?

by ic-it

There was a way, just not so simple, doh. ;-) :-)

by slayer_

While trying to figure out how to modify the index pages that apache creates. No easy task...

by slayer_

in the htaccess file

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?companysite.com(/)?.*$ [NC]
RewriteRule .*\.(pdf)$ http://companysite.com/Denied.jpg [R,NC]

For the last line, you can change denied.jpg to anything, even another PDF or webpage.
The point of this code is to block access to the files in that folder unless the referrer is companysite.com (You can make this more specific). This won't save you though if they first go to your site, to the automatically generated index of the PDF's and then try and open one, since this will show the correct referrals, unless you make it more specific.

The referral is the weblink you were on before the link loaded. This does not count if you just type in the link, then the referral will be blank.

by tink!

Can you pinpoint the parts of the code for me a bit please?

I actually used the code this way:

RewriteEngine on
#RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://companysite.com/pdfs/MSDS.*$ [NC]
RewriteRule \.(pdf|PDF)$ http://companysite.com/denied.html

For whatever reason, the first RewriteCond would still allow access. As well, having te [R,NC] after the RewriteRule would also allow access.

Can you explain that?

by slayer_

Its basically if the referrer is not ____ then display ____ for ____ files.

But I put it together from various sources on the net.

Oh, also the very first one is commented out, sorry, forgot to delete it.

The last R,NC as I understand it, is to allow access to the redirected content.

I use it on my server, so for example if you try and place this image on your server Via a hotlink, it won't work.
http://trevorsarchives.selfip.net/funpics/images/lal.jpg

by tink!

I did the commenting out - LOL. When it didn't work with that line in, I commented it.

Now my problem is, how do I, myself open the pdf files without getting denied (because I am).

Obviously the normal referral link is not going to work so there must be a way to tell the site to open the file but without using the url?

by tink!

I have logs, but nothing that looks like that.

I think the problem is that the link on our website which is supposed to open the PDF file is a simple hyperlink.

So it uses the exact same address as I just blocked with the htaccess code.

Now, is there a way in ASP code that I can embed, or script open a PDF file?

by tink!

a javascript or an ASP script then.

oh. I think I just thought of something as I'm typing this.

In the meantime do you happen to have a Javascript handy for linking to or downloading a page?

Thanks.

by slayer_

For example, to check a cookie instead of the referrer.

Exchange HTTP_REFERER for HTTP_COOKIE

Go to this page for more info
http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html

Specifically, do an edit/find and search for "RewriteCond Directive" to get to a section that would be more helpful for you. Their documentation is cryptic, but you can often use it to get an idea on what to google for for examples.

by tink!

The HTTP_COOKIE was the way to go.

RewriteEngine on
RewriteCond %{HTTP_COOKIE} !^.*cookie.*$ [NC]
RewriteRule .* http://companysite.com/denied.html

I've changed the login page to add a cookie for the browser session.

The htaccess file now redirects if there is no cookie and the user tries to type the direct URL to the pdf file.

Thanks a bunch!

PS. I've found that askapache.com is a bit easier to comprehend than httpd.apache.org

by slayer_

You could just tell your script to just redirect the page. That's how you do it in javascript anyways, just a normal link to the PDF, then depending on the users computer, it either opens it or downloads it.

And my logs are custom, I have apache writing out the access and referral logs, then I have a program running in the background that combines the two and makes an HTML table out of them, based on a series of patterns I define.

So I can tell it, everything with the path "/images/" to be written to my images log.
The program then reads this file, creates the log, and then searches thru the access log created by Apache for a match, when it finds one, it writes out what it finds in the access log and the referral log. It's not done in real time though, about every 10 minutes it updates. Takes about 5 minutes to update it :) (Server is only a 350mhz machine and is a dog).
http://trevorsarchives.selfip.net/log/

I also have another log that reads my allowed hotlinking list, and shows who is trying too.
Such as:
http://fsboards.levelupgames.ph/index.php?showtopic=2369

So when my site says if you hotlink, I will track you down and steal your computer, I'm not joking :)

by slayer_

Even load, just place this code.

window.location="page2.htm"

Or you can get really fancy in ASP
Response.Redirect "PDF File link"

by slayer_

I do like have learning resources :).

Glad I could help.

One question for you though, what happens if you login, then leave the site then type the PDF manually, does it work then?

by tink!

I was going to actually post a question or discussion on that at a later time.

Right now if you just navigate away from the site and then type the address it will work.

If you close the browser, however, it ends the session and the cookie expires.

I'm not too worried about this just yet because the documents available are not sensitive. In the future however, we may put customer specific info and then we'll want to be more careful.

I started looking up scripts on how to close browsers when navigating away, but haven't gotten very far yet.

by slayer_

Message forums and other things work the same way. Best way I can think of is have your cookie contain a code, this way a potential hacker couldn't just drop that cookie on their own system and get easy access to the documents.

I know at the Calgary airport, they do this thing where you have access to the internet, as long as you leave their timer window open. I figure that timer window could probably delete the cookie or something when the browser window is closed or the time runs out.

So basically when you log in, it opens another window, this window generates the cookie, and as long as it remains open (even if minimized) the cookie remains.
Make sure the only way to spawn this window is to correctly login.

This is just an idea though, I'd have to try it to see if it is practical or not.

This discussion is closed to new replies.