Preventing 'hot links' on SunONE 6.1 SP5?
Hi there,
My conversion from Apache to SunONE went like a charm and right now I'm very happy with the end results. The only thing which is giving me a little trouble are the ACL's. I got the whole site secured (as far as I can see) but I was wondering if it is possible to deny access based on referrer ?
On Apache I used this approach to protect directories which contained the website images so that they could only be used from local websites thus preventing hot linking.
I've been over the documentation a few times and although I have no trouble finding options to deny access based on username or time of day I can't find anything related to referrers. Searching google only gets me on websites explaining the procedure for Squid or Apache and well, I don't have the intention of utilizing a proxy.
I think this isn't possible using SunONE ACL's but a Java program in a jsp page might be able to do the trick for me. However, before that I hope someone can hint me in the right direction.
[1032 byte] By [
Lion-O] at [2007-11-26 7:43:24]
# 1
Nice to hear about the succesful migration from apache.You can take action based on referer (or other headers) but it's not done in the ACLs, as you concluded. See the 4th post in this thread for an example: http://forum.sun.com/jive/thread.jspa?forumID=16&threadID=61517
jyri at 2007-7-6 19:52:48 >
# 3
> You can take action based on referer (or other
> headers) but it's not done in the ACLs, as you
> concluded.
I should have anticipated this, but totally looked it. Some time ago I already managed (with the help of some tips here) to get specific options to work based on virtual hosts (<Client urlhost="fqdn"></Client>) but totally overlooked the option to check based on the headers.
Thanks for the pointer, its working like a charm now. I'll be sure to pay a little more attention to the other available options.
I'm actually quite pleased with this option, IMO its even better than the approach Apache used. On Apache I basicly denied access based on this information while this approach simply denies its existance. I consider that to be a lot safer.
LionO at 2007-7-6 19:52:48 >
