Hotlink protection

[aydos (Fahri Aydos)]

Hi,
There is a closed issue on github: https://github.com/mholt/caddy/issues/402
As I mentioned there, I got error:

http://test.local {
	rewrite {
		if {>Referer} not test.local
		status 403
	}
}

2017/01/29 22:23:48 /etc/caddy/caddy.conf:60 - Parse error: Wrong argument count or unexpected line ending after 'status'

What is the solution?

[matt (Matt Holt)]

Use the status directive instead - but it only supports paths, not if statements.

[aydos (Fahri Aydos)]

Ok, I tried:

	rewrite {
		if {>Referer} not test.local
		to /hotlink 
	}
	status 403 /hotlink

It gives 403 for index.html

• Do you have a working example for hotlink protection?
• {>Referer} is not listed in the placeholders.

thanks

[aydos (Fahri Aydos)]

Ok. This seems working on local virtual test sites:

http://test.local {
	root   /var/www/test/
	rewrite {
		if {>Referer} not ""
		if {>Referer} not "http://test.local/"
		to /hotlink 
	}
	status 403 /hotlink
}

[aydos (Fahri Aydos)]

Correction. {>Referer} is the full url. So we must use regex and check if it start with our site. Otherwise we will miss urls like : “http://example.com/http://test.local”

http://test.local {
	root   /var/www/test/
	rewrite {
		if {>Referer} not ""
		if {>Referer} not_match ^http:\/\/test\.local
		to /hotlink 
	}
	status 403 /hotlink
}

[Whitestrake (Matthew Fay)]

To clarify for other readers:

if {>Referer} not "http://test.local/" will stop requests refered by both http://example.com/http://test.local/ and http://test.local/test, for example. It’s an exact match (opposite of is).

if {>Referer} not_has "http://test.local/" will NOT stop a request refered by http://example.com/http://test.local. The likelihood of that happening in normal browser behaviour is incredibly unlikely, however.

Check out the rewrite docs for specific conditional behaviour.