1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
|
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
This file is generated from xml source: DO NOT EDIT
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-->
<title>Using mod_rewrite to control access - Apache HTTP Server Version 2.5</title>
<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
<script src="../style/scripts/prettify.min.js" type="text/javascript">
</script>
<link href="../images/favicon.ico" rel="shortcut icon" /></head>
<body id="manual-page"><div id="page-header">
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
<p class="apache">Apache HTTP Server Version 2.5</p>
<img alt="" src="../images/feather.gif" /></div>
<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
<div id="path">
<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.5</a> > <a href="./">Rewrite</a></div><div id="page-content"><div id="preamble"><h1>Using mod_rewrite to control access</h1>
<div class="toplang">
<p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English"> en </a></p>
</div>
<p>This document supplements the <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code>
<a href="../mod/mod_rewrite.html">reference documentation</a>. It describes
how you can use <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> to control access to
various resources, and other related techniques.
This includes many examples of common uses of mod_rewrite,
including detailed descriptions of how each works.</p>
<div class="warning">Note that many of these examples won't work unchanged in your
particular server configuration, so it's important that you understand
them, rather than merely cutting and pasting the examples into your
configuration.</div>
</div>
<div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#blocked-inline-images">Forbidding Image "Hotlinking"</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#blocking-of-robots">Blocking of Robots</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#host-deny">Denying Hosts in a Blacklist</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#referer-deflector">Referer-based Deflector</a></li>
</ul><h3>See also</h3><ul class="seealso"><li><a href="../mod/mod_rewrite.html">Module documentation</a></li><li><a href="intro.html">mod_rewrite introduction</a></li><li><a href="remapping.html">Redirection and remapping</a></li><li><a href="vhosts.html">Virtual hosts</a></li><li><a href="proxy.html">Proxying</a></li><li><a href="rewritemap.html">Using RewriteMap</a></li><li><a href="advanced.html">Advanced techniques</a></li><li><a href="avoid.html">When not to use mod_rewrite</a></li></ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="blocked-inline-images" id="blocked-inline-images">Forbidding Image "Hotlinking"</a></h2>
<dl>
<dt>Description:</dt>
<dd>
<p>The following technique forbids the practice of other sites
including your images inline in their pages. This practice is
often referred to as "hotlinking", and results in
your bandwidth being used to serve content for someone else's
site.</p>
</dd>
<dt>Solution:</dt>
<dd>
<p>This technique relies on the value of the
<code>HTTP_REFERER</code> variable, which is optional. As
such, it's possible for some people to circumvent this
limitation. However, most users will experience the failed
request, which should, over time, result in the image being
removed from that other site.</p>
<p>There are several ways that you can handle this
situation.</p>
<p>In this first example, we simply deny the request, if it didn't
initiate from a page on our site. For the purpose of this example,
we assume that our site is <code>www.example.com</code>.</p>
<pre class="prettyprint lang-config">RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !www.example.com [NC]
RewriteRule \.(gif|jpg|png)$ - [F,NC]</pre>
<p>In this second example, instead of failing the request, we display
an alternate image instead.</p>
<pre class="prettyprint lang-config">RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !www.example.com [NC]
RewriteRule \.(gif|jpg|png)$ /images/go-away.png [R,NC]</pre>
<p>In the third example, we redirect the request to an image on some
other site.</p>
<pre class="prettyprint lang-config">RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !www.example.com [NC]
RewriteRule \.(gif|jpg|png)$ http://other.example.com/image.gif [R,NC]</pre>
<p>Of these techniques, the last two tend to be the most effective
in getting people to stop hotlinking your images, because they will
simply not see the image that they expected to see.</p>
</dd>
<dt>Discussion:</dt>
<dd>
<p>If all you wish to do is deny access to the resource, rather
than redirecting that request elsewhere, this can be
accomplished without the use of mod_rewrite:</p>
<pre class="prettyprint lang-config">SetEnvIf Referer example\.com localreferer
<FilesMatch \.(jpg|png|gif)$>
Require env localreferer
</FilesMatch></pre>
</dd>
</dl>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="blocking-of-robots" id="blocking-of-robots">Blocking of Robots</a></h2>
<dl>
<dt>Description:</dt>
<dd>
<p>
In this recipe, we discuss how to block persistent requests from
a particular robot, or user agent.</p>
<p>The standard for robot exclusion defines a file,
<code>/robots.txt</code> that specifies those portions of your
website where you wish to exclude robots. However, some robots
do not honor these files.
</p>
<p>Note that there are methods of accomplishing this which do
not use mod_rewrite. Note also that any technique that relies on
the clients <code>USER_AGENT</code> string can be circumvented
very easily, since that string can be changed.</p>
</dd>
<dt>Solution:</dt>
<dd>
<p>We use a ruleset that specifies the directory to be
protected, and the client <code>USER_AGENT</code> that
identifies the malicious or persistent robot.</p>
<p>In this example, we are blocking a robot called
<code>NameOfBadRobot</code> from a location
<code>/secret/files</code>. You may also specify an IP address
range, if you are trying to block that user agent only from the
particular source.</p>
<pre class="prettyprint lang-config">RewriteCond %{HTTP_USER_AGENT} ^NameOfBadRobot
RewriteCond %{REMOTE_ADDR} =123\.45\.67\.[8-9]
RewriteRule ^/secret/files/ - [F]</pre>
</dd>
<dt>Discussion:</dt>
<dd>
<p>
Rather than using mod_rewrite for this, you can accomplish the
same end using alternate means, as illustrated here:
</p>
<pre class="prettyprint lang-config">SetEnvIfNoCase User-Agent ^NameOfBadRobot goaway
<Location /secret/files>
<RequireAll>
Require all granted
Require not env goaway
</RequireAll>
</Location></pre>
<p>
As noted above, this technique is trivial to circumvent, by simply
modifying the <code>USER_AGENT</code> request header. If you
are experiencing a sustained attack, you should consider blocking
it at a higher level, such as at your firewall.
</p>
</dd>
</dl>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="host-deny" id="host-deny">Denying Hosts in a Blacklist</a></h2>
<dl>
<dt>Description:</dt>
<dd>
<p>We wish to maintain a blacklist of hosts, rather like
<code>hosts.deny</code>, and have those hosts blocked from
accessing our server.</p>
</dd>
<dt>Solution:</dt>
<dd>
<pre class="prettyprint lang-config">RewriteEngine on
RewriteMap hosts-deny txt:/path/to/hosts.deny
RewriteCond ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]
RewriteCond ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND
RewriteRule ^ - [F]</pre>
<div class="example"><p><code>
##<br />
## hosts.deny<br />
##<br />
## ATTENTION! This is a map, not a list, even when we treat it as such.<br />
## mod_rewrite parses it for key/value pairs, so at least a<br />
## dummy value "-" must be present for each entry.<br />
##<br />
<br />
193.102.180.41 -<br />
bsdti1.sdm.de -<br />
192.76.162.40 -<br />
</code></p></div>
</dd>
<dt>Discussion:</dt>
<dd>
<p>
The second RewriteCond assumes that you have HostNameLookups turned
on, so that client IP addresses will be resolved. If that's not the
case, you should drop the second RewriteCond, and drop the
<code>[OR]</code> flag from the first RewriteCond.
</p>
</dd>
</dl>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="referer-deflector" id="referer-deflector">Referer-based Deflector</a></h2>
<dl>
<dt>Description:</dt>
<dd>
<p>Redirect requests based on the Referer from which the request
came, with different targets per Referer.</p>
</dd>
<dt>Solution:</dt>
<dd>
<p>The following ruleset uses a map file to associate each Referer
with a redirection target.</p>
<pre class="prettyprint lang-config">RewriteMap deflector txt:/path/to/deflector.map
RewriteCond %{HTTP_REFERER} !=""
RewriteCond ${deflector:%{HTTP_REFERER}} =-
RewriteRule ^ %{HTTP_REFERER} [R,L]
RewriteCond %{HTTP_REFERER} !=""
RewriteCond ${deflector:%{HTTP_REFERER}|NOT-FOUND} !=NOT-FOUND
RewriteRule ^ ${deflector:%{HTTP_REFERER}} [R,L]</pre>
<p>The map file lists redirection targets for each referer, or, if
we just wish to redirect back to where they came from, a "-" is
placed in the map:</p>
<pre class="prettyprint lang-config">##<br />
## deflector.map<br />
##<br />
<br />
http://badguys.example.com/bad/index.html -<br />
http://badguys.example.com/bad/index2.html -<br />
http://badguys.example.com/bad/index3.html http://somewhere.example.com/</pre>
</dd>
</dl>
</div></div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English"> en </a></p>
</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
<script type="text/javascript"><!--//--><![CDATA[//><!--
var comments_shortname = 'httpd';
var comments_identifier = 'http://httpd.apache.org/docs/trunk/rewrite/access.html';
(function(w, d) {
if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
d.write('<div id="comments_thread"><\/div>');
var s = d.createElement('script');
s.type = 'text/javascript';
s.async = true;
s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
(d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
}
else {
d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
}
})(window, document);
//--><!]]></script></div><div id="footer">
<p class="apache">Copyright 2015 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
if (typeof(prettyPrint) !== 'undefined') {
prettyPrint();
}
//--><!]]></script>
</body></html>
|
