Dear All,

I am using the code at the end of this message to restrict access to a specific directory and sub-directories. The code is supposed to return a 403 error if direct access to the files identified by the extensions below is attempted - and it is supposed to allow access to those files if the referring website is mydomain.com.

I am specifically interested in accessing pdf files (last on the list) and Acrobat seems to choke when I connect from the correct referring site. This does not seem to happen with other applications such as MSWord.

I have not played with this for some time but was under the impression that this arrangement worked very well in the past in other places where I tried to block direct access.

Now I discover that even referrals from mydomain.com fail. I can access pdf files if I remove them from the .htaccess list and they get blocked if I add them back. It seems to make no difference if I open a new window or not. I am sure that this worked in the past.

I am using Apache 2.x and Linux Fedora Core 4 on a VPS to which I have root access - I am not very experienced with .htaccess and would appreciate any help.

Thanks - Andrew

***************** CODE begins ***************
Options All -Indexes

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://www.mydomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://mydomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.mydomain.com$ [NC]
RewriteCond %{HTTP_REFERER} !^http://mydomain.com$ [NC]
RewriteRule .*\.(php|htm|html|inc|jpg|jpeg|gif|png|bmp|swf|mpg|avi|wav|mp3|zip|tgz|bak|doc|pdf)$ - [F,NC]

try this:

RewriteRule (.*)\.(php|htm|html|inc|jpg|jpeg|gif|png|bmp|swf|mpg|avi|wav|mp3|zip|tgz|bak|doc|pdf)$ - [F,L]

I don't *think* you can use NC in this line. Pay attention to the parens I placed in front.

edit:

Actually, that list of extensions looks pretty comprehensive. I actually don't see anything that COULD be accessed. If it is your intent to block everyone who tries to deep link, you might just use this line:

RewriteRule .* - [F,L]

You also could simplify your rewrite rules like this: replace all 4 lines you have with this one:

RewriteCond %{HTTP_REFERER} !(mydomain) [NC]

This picks up all the variants that you want to pick up, though it also would pick up things you didn't intend such as mydomainrules.com

Thank you so much - it all seems to be working - Andrew