Ref-feral check in apache

vishalsamyal · 11-03-2012, 04:30 AM

Hello,

I am facing problem while adding ref-reral check in apache. Like

Whenever any one hit "http://abc.com/def/now.do", "now.do" file is opening.I want when ever anyone hit "http://abc.ocm/def/now.do". It should not be open, but when ever hit comes from internal java application It should responce to java application.

I am applying following rule, But it's not working,

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} ^http://abc.com/ [NC]
RewriteRule ^/def\.(do)$ - F

Any help will be appreciable.

bathory · 11-03-2012, 09:07 AM

Hi,

First of all you have an error in the RewriteRule. You have to enclose F with square brackets (like [F])
Also your problem description is not very clear. I guess you don't want anyone to access /def/now.do (or is it for any .do file?), if it's not coming from your server.
In this case you can put in apache .conf file the following:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://abc.com/ [NC]
RewriteRule ^/def/(.do)$ - [F]

Regards

vishalsamyal · 11-03-2012, 09:57 AM

Thanks for your reply, But apache is still serving this url:

I do not want that apache serve for any request that comes to directly "http://abc.com/def/*.do".
Example:
http://abc.com/def/abc.do ----- should not serve.
http://abc.com/def/xyz.do ----- should not serve.

I want only one thing that is "http://abc.com/def/*.do" should not open directly in any internet explorer like(firefox, google chrome, IE.

Any help will be appreciable.

bathory · 11-03-2012, 03:48 PM

If you want to allow access to *.do only from a specific page, through a link or something, then use:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://abc.com/specific.html$ [NC]
RewriteRule ^/def/(.do)$ - [F]

Cheers

vishalsamyal · 11-05-2012, 03:12 AM

If I want to allow *.do to multiple html pages, Then?
Actually I have to allow it for multiple pages in the website.

bathory · 11-05-2012, 06:16 AM

Quote:

Originally Posted by vishalsamyal

If I want to allow *.do to multiple html pages, Then?
Actually I have to allow it for multiple pages in the website.

You must see if there is a common pattern for those pages and use that in the RewriteCond line. Or use an [OR] flag like:

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://abc.com/one.html$ [NC,OR]
RewriteCond %{HTTP_REFERER} !^http://abc.com/two.html$ [NC,OR]
...
RewriteCond %{HTTP_REFERER} !^http://abc.com/last.html$ [NC,OR]
RewriteRule ^/def/(.do)$ - [F]

vishalsamyal · 11-05-2012, 06:24 AM

Thx for your reply..

But with this rule I am getting the same error on even on "http://abc.com/one.html".
This url is also not opening and still getting "*.do" file in browser.

bathory · 11-05-2012, 11:30 AM

Quote:

Originally Posted by vishalsamyal

Thx for your reply..

But with with rule am getting the same error on even on "http://abc.com/one.html".
This url is also not opening and still getting "*.do" file in browser.

What error you get?
I had a typo in the rewrite rule, so you may try the following:

Code:

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://abc.com/(one|two|last).html$
RewriteRule ^/def/(.*).do$ - [F]

vishalsamyal · 11-06-2012, 02:33 AM

I applied the that url like :

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://abc.com/(one|two|last).html$
RewriteRule ^/def/(.*).do$ - [F]

But with this rule "http://abc.com/def/lsthw.do" is still opening in browser. And I do not want that browser opened this url anymore.

bathory · 11-06-2012, 03:24 AM

Quote:

But with this rule "http://abc.com/def/lsthw.do" is still opening in browser. And I do not want that browser opened this url anymore.

Then delete the line

Quote:

RewriteCond %{HTTP_REFERER} !^$

Cheers

vishalsamyal · 11-06-2012, 04:53 AM

No!! it's not working.

Anyway thx for your reply!!!!