Richard S. Crawford wrote:
Isn't it exactly the same problem, though? In either case, you're trying to make sure that HTTP's Referer field is set.We've got some .pdf documents on our website that we'd rather people not view by directly typing the URL into the browser; we want them to get there via a link.
My boss is convinced that we can do this using the same tricks with the
.htaccess file that can be used to prevent images from being stolen. I'm
not entirely sure about that.
#<FilesMatch "\.pdf$">The above seems right. I don't know whether there are bugs in it, or what, but that's the idea.
#SetEnvIf Referer "http://152.79.198.7"; local_referrer=1
#Order Allow, Deny
#Deny from all
#Allow from env=local_referrer
#</FilesMatch>
'Course, nothing's gonna work if it's commented out ;-)
It's not foolproof: with wget, for example, you could forge a Referer field. But the chances of encountering that are pretty low; and anyway, there's not much you could do about it, short of actually authenticating the tokens.
Since you seem to be using ColdFusion (evidence has been snipped), you could probably write a short wrapper that will serve up the pdf file if the person "deserves" it; and remove the PDF files to outside of the web docs repository.
BTW, don't ColdFusion suck? :-)
-Micah
_______________________________________________ vox-tech mailing list vox-tech@lists.lugod.org http://lists.lugod.org/mailman/listinfo/vox-tech
