1

I have a gallery with pictures. If anybody links my gallery pictures from somewhere else (remote server), a forbitten image should be shown. This basically works, but now I recognized a strange behaviour with my rewrite rule. Here is the rule:

RewriteEngine on 
RewriteCond %{HTTP_REFERER} !^$ 
RewriteCond %{HTTP_REFERER} !^http://www.mydomain.net/pictures/.*$ [NC]   
RewriteRule .*\.(png|PNG)$ http://www.mydomain.net/pics/linkingpicsforbitten.png [R,L]

What exactly happens: The gallery consists of shtml pages which links the pictures with relative paths and I can browse the pictures with back and forward. This works, every picture is shown. When I invoke the page on the evil remote server, which links a picture of my gallery, the remote server gets the forbitten image which is the wanted effect, but now something strange happens: Back on my own server, when I browse in my picture gallery to the picture which has been invoked by the evil remote server, I suddendly get the forbitten image there too, even in my gallery. When I hit F5 to reload the gallery, the picture works again. But this is not acceptable.
What can I do? I tried to change and combine or leave the flags of the RewriteRule but nothing can help. The only acceptable solution would be to set the [F] flag. In this case the evil remote server doesn't see the forbitten image but a blank page but at least my gallery works every time. But I'd rather want the forbitten image to be working. Any ideas?

Bevor
  • 113
  • 1
  • 11

2 Answers2

2

The forbidden image is being cached in your web browser. You need to use mod_headers to set it to never cache.

Try:

<FilesMatch "linkingpicsforbitten\.png$">
<IfModule mod_headers.c>
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
Header set Pragma "no-cache"
Header set Expires "Wed, 11 Jan 1984 05:00:00 GMT"
</IfModule>
</FilesMatch>
Mike Scott
  • 7,903
  • 29
  • 26
1

I believe your browser is just caching the forbidden image. You should be able to use mod_expires to enforce a no-caching policy on just your forbidden image.

JakePaulus
  • 2,347
  • 16
  • 17