Blocking Image Hotlinking, Leeching and Evil Sploggers with Url Rewrite

http://www.hanselman.com/blog/BlockingImageHotlinkingLeechingAndEvilSploggersWithIISUrlRewrite.aspx

by shawndumas • 13 years ago

49 19 13 years ago

hanselman.com

thomaslutz• 13 years ago

The only new thing in this post here is how to do this in IIS, but I guess nobody is using IIS here.

junto• 13 years ago

Your guess is wrong :)

pi18n2• 13 years ago

We seen opportunistic vultures use the DMCA to lawlessly enforce their censorship, but when a case it's actually designed for comes up...

Maybe he already thought of it, but it might also help to send DMCA notices to Google as well as the website's registrar and host. I'd love to see a bad guy get taken down by the good guys for once.

pdwetz• 13 years ago

Agreed that DMCA can also be used, but that only applies to US hosts/sites. His approach lets you handle other cases and also takes effect immediately.

pi18n2• 13 years ago

I was not thinking of that and you are absolutely right.

hawleyal2• 13 years ago

You're breaking the internet.

krapp2• 13 years ago

You can have everyone's images when you're willing to pay them for the bandwidth. The internet has changed (unfortunately.)

chollida1• 13 years ago

How so? I mean this as an honest question. how does this "break the internet"?

I configure my browser to send the referrer as the site I'm currently on as I don't believe a site has the right to know where I've come from. Does this also break the internet?

twistedpair• 13 years ago

Three cheers. Never trust a "referrer" header. But now you're a "hacker," right?

AJ007• 13 years ago

For smaller sites it is not unusual for a hot linked image to use more bandwidth than the rest of an entire site many times over.

This isn't an issue for me any more, but I had some ideas over the years -

1) Make hotlink images serve pictures with a massive watermark. This way you get free branding/advertising.

2) Serve specific images to specific problem hot linkers, for example "Pinterest sucks (insert favorite word)."

2) If you are more malicious, make the behavior random so it isn't immediately evident to the site owner/moderator what is going on.

Image attribution gets little respect, just take a look at what happened to Google Images. The service went from being obvious (to the mass market user) where the image was coming from (assuming it was being published by the original owner) to now it just looks like Google has their own stock photography service.

Irregardless of your opinion on copyright, everyone agrees on attribution when it comes to code. As far as I believe the same is true for images. Hotlinking is the tip of a very problematic iceberg.

Steuard• 13 years ago

How? Hotlinking of images on someone else's site has been viewed as inappropriate as long as I can remember (was it okay before 1995?). It's not wise design in any case: what if they remove it or reorganize their site? (Hyperlinks to other peoples' pages have always been okay, but that's not what we're talking about here.)

hawleyal2• 13 years ago

Hotlinking or embedding on another site is not the only thing that breaks.

- Downloading

- Search engines

- Caching

- Sharing (usually nabs thumbnail)

It's just not a good idea. And it doesn't really work. Any scraper worth their salt would just fake the referrer and be fine.

Ricapar• 13 years ago

Thank you for using a specific blacklist on HTTP_REFERER.

Worst I've seen done is when sites will throw the stupid "No Hotlinking" message image when they don't see a matching referrer from the same domain. In other words, a "fuck you" to anyone who decides to configure their browser to not send referrers.

warcode• 13 years ago

Configure your browser to send the target domain as the referrer and you won't have that issue.

In fact it even makes any hotlinking filters set up like this not work at all, and serve you the picture normally.

blantonl• 13 years ago

I use this simple rewrite rule to prevent user submitted images from being used on other sites...

  <Directory /images>
          RewriteEngine On
          RewriteCond %{HTTP_REFERER} !^$
          RewriteCond %{HTTP_REFERER} !mydomain.com
          RewriteRule .*\.(gif|jpg|png)$ http://images.mydomain.com/no.gif [NC]
  </Directory>

krapp2• 13 years ago

I've used this method too. But I thought the image type you were supposed to serve as an alternative had to use a nonstandard extension (like .jpe)?

program• 13 years ago

Unfortunately this approach does not work in HTTPS world. See https://tools.ietf.org/html/rfc2616#section-15.1.3

    Clients SHOULD NOT include a Referer header field
    in a (non-secure) HTTP request if the referring page
    was transferred with a secure protocol.

RKearney• 13 years ago

This only will not work if your page is loaded over HTTPS and your assets are done over HTTP.

If your site and all of the linked/embedded assets are HTTPS, it will work as intended.

davidgerard• 13 years ago

Of course, Jason Scott already won at this. http://ascii.textfiles.com/archives/1011

Blocking Image Hotlinking, Leeching and Evil Sploggers with Url Rewrite

Related Stories