granicus.if.org Git - apache/blob - docs/manual/rewrite/access.html.en

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
   4         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   5               This file is generated from xml source: DO NOT EDIT
   6         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   7       -->
   8 <title>Using mod_rewrite to control access - Apache HTTP Server</title>
   9 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
  10 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
  11 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
  12 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
  13 <body id="manual-page"><div id="page-header">
  14 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
  15 <p class="apache">Apache HTTP Server Version 2.3</p>
  16 <img alt="" src="../images/feather.gif" /></div>
  17 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
  18 <div id="path">
  19 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.3</a> &gt; <a href="./">Rewrite</a></div><div id="page-content"><div id="preamble"><h1>Using mod_rewrite to control access</h1>
  20 <div class="toplang">
  21 <p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English">&nbsp;en&nbsp;</a></p>
  22 </div>
  23
  24
  25 <p>This document supplements the <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code>
  26 <a href="../mod/mod_rewrite.html">reference documentation</a>. It describes
  27 how you can use <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> to control access to
  28 various resources, and other related techniques.
  29 This includes many examples of common uses of mod_rewrite,
  30 including detailed descriptions of how each works.</p>
  31
  32 <div class="warning">Note that many of these examples won't work unchanged in your
  33 particular server configuration, so it's important that you understand
  34 them, rather than merely cutting and pasting the examples into your
  35 configuration.</div>
  36
  37 </div>
  38 <div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#blocked-inline-images">Forbidding Image "Hotlinking"</a></li>
  39 <li><img alt="" src="../images/down.gif" /> <a href="#blocking-of-robots">Blocking of Robots</a></li>
  40 <li><img alt="" src="../images/down.gif" /> <a href="#host-deny">Denying Hosts in a Blacklist</a></li>
  41 <li><img alt="" src="../images/down.gif" /> <a href="#referer-deflector">Referer-based Deflector</a></li>
  42 </ul><h3>See also</h3><ul class="seealso"><li><a href="../mod/mod_rewrite.html">Module documentation</a></li><li><a href="intro.html">mod_rewrite introduction</a></li><li><a href="remapping.html">Redirection and remapping</a></li><li><a href="advanced.html">Advanced techniques and tricks</a></li><li><a href="avoid.html">When not to use mod_rewrite</a></li></ul></div>
  43 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
  44 <div class="section">
  45 <h2><a name="blocked-inline-images" id="blocked-inline-images">Forbidding Image "Hotlinking"</a></h2>
  46
  47
  48
  49       <dl>
  50         <dt>Description:</dt>
  51
  52         <dd>
  53           <p>The following technique forbids the practice of other sites
  54           including your images inline in their pages. This practice is
  55           often referred to as "hotlinking", and results in
  56           your bandwidth being used to serve content for someone else's
  57           site.</p>
  58         </dd>
  59
  60         <dt>Solution:</dt>
  61
  62         <dd>
  63           <p>This technique relies on the value of the
  64           <code>HTTP_REFERER</code> variable, which is optional. As
  65           such, it's possible for some people to circumvent this
  66           limitation. However, most users will experience the failed
  67           request, which should, over time, result in the image being
  68           removed from that other site.</p>
  69           <p>There are several ways that you can handle this
  70           situation.</p>
  71
  72     <p>In this first example, we simply deny the request, if it didn't
  73     initiate from a page on our site. For the purpose of this example,
  74     we assume that our site is <code>www.example.com</code>.</p>
  75
  76 <div class="example"><pre>
  77 RewriteCond %{HTTP_REFERER} <strong>!^$</strong>
  78 RewriteCond %{HTTP_REFERER} !www.example.com [NC]
  79 RewriteRule <strong>\.(gif|jpg|png)$</strong>    -   [F,NC]
  80 </pre></div>
  81
  82     <p>In this second example, instead of failing the request, we display
  83     an alternate image instead.</p>
  84
  85 <div class="example"><pre>
  86 RewriteCond %{HTTP_REFERER} <strong>!^$</strong>
  87 RewriteCond %{HTTP_REFERER} !www.example.com [NC]
  88 RewriteRule <strong>\.(gif|jpg|png)$</strong>    /images/go-away.png   [R,NC]
  89 </pre></div>
  90
  91     <p>In the third example, we redirect the request to an image on some
  92     third-party site.</p>
  93
  94 <div class="example"><pre>
  95 RewriteCond %{HTTP_REFERER} <strong>!^$</strong>
  96 RewriteCond %{HTTP_REFERER} !www.example.com [NC]
  97 RewriteRule <strong>\.(gif|jpg|png)$</strong> http://other.site.com/image.gif   [R,NC]
  98 </pre></div>
  99
 100     <p>Of these techniques, the last two tend to be the most effective
 101     in getting people to stop hotlinking your images, because they will
 102     simply not see the image that they expected to see.</p>
 103
 104         </dd>
 105
 106         <dt>Discussion:</dt>
 107
 108         <dd>
 109         <p>If all you wish to do is deny access to the resource, rather
 110         than redirecting that request elsewhere, this can be
 111         accomplished without the use of mod_rewrite:</p>
 112
 113         <div class="example"><p><code>
 114         SetEnvIf Referer example\.com localreferer<br />
 115         &lt;FilesMatch \.(jpg|png|gif)$&gt;<br />
 116         Order deny,allow<br />
 117         Deny from all<br />
 118         Allow from env=localreferer<br />
 119         &lt;/FilesMatch&gt;
 120         </code></p></div>
 121         </dd>
 122       </dl>
 123
 124     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 125 <div class="section">
 126 <h2><a name="blocking-of-robots" id="blocking-of-robots">Blocking of Robots</a></h2>
 127
 128
 129
 130       <dl>
 131         <dt>Description:</dt>
 132
 133         <dd>
 134         <p>
 135         In this recipe, we discuss how to block persistent requests from
 136         a particular robot, or user agent.</p>
 137
 138         <p>The standard for robot exclusion defines a file,
 139         <code>/robots.txt</code> that specifies those portions of your
 140         website where you which to exclude robots. However, some robots
 141         do not honor these files.
 142         </p>
 143
 144         <p>Note that there are methods of accomplishing this which do
 145         not use mod_rewrite. Note also that any technique that relies on
 146         the clients <code>USER_AGENT</code> string can be circumvented
 147         very easily, since that string can be changed.</p>
 148         </dd>
 149
 150         <dt>Solution:</dt>
 151
 152         <dd>
 153         <p>We use a ruleset that specifies the directory to be
 154         protected, and the client <code>USER_AGENT</code> that
 155         identifies the malicious or persistent robot.</p>
 156
 157         <p>In this example, we are blocking a robot called
 158         <code>NameOfBadRobot</code> from a location
 159         <code>/secret/files</code>. You may also specify an IP address
 160         range, if you are trying to block that user agent only from the
 161         particular source.</p>
 162
 163 <div class="example"><pre>
 164 RewriteCond %{HTTP_USER_AGENT}   ^<strong>NameOfBadRobot</strong>
 165 RewriteCond %{REMOTE_ADDR}       =<strong>123\.45\.67\.[8-9]</strong>
 166 RewriteRule ^<strong>/secret/files/</strong>   -   [<strong>F</strong>]
 167 </pre></div>
 168         </dd>
 169
 170       <dt>Discussion:</dt>
 171
 172       <dd>
 173       <p>
 174         Rather than using mod_rewrite for this, you can accomplish the
 175         same end using alternate means, as illustrated here:
 176       </p>
 177       <div class="example"><p><code>
 178       SetEnvIfNoCase User-Agent ^NameOfBadRobot goaway<br />
 179       &lt;Location /secret/files&gt;<br />
 180       Order allow,deny<br />
 181       Allow from all<br />
 182       Deny from env=goaway<br />
 183       &lt;/Location&gt;
 184       </code></p></div>
 185       <p>
 186       As noted above, this technique is trivial to circumvent, by simply
 187       modifying the <code>USER_AGENT</code> request header. If you
 188       are experiencing a sustained attack, you should consider blocking
 189       it at a higher level, such as at your firewall.
 190       </p>
 191
 192       </dd>
 193
 194       </dl>
 195
 196     </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 197 <div class="section">
 198 <h2><a name="host-deny" id="host-deny">Denying Hosts in a Blacklist</a></h2>
 199
 200
 201
 202   <dl>
 203     <dt>Description:</dt>
 204
 205     <dd>
 206       <p>We wish to maintain a blacklist of hosts, rather like
 207       <code>hosts.deny</code>, and have those hosts blocked from
 208       accessing our server.</p>
 209     </dd>
 210
 211     <dt>Solution:</dt>
 212
 213     <dd>
 214 <div class="example"><pre>
 215 RewriteEngine on
 216 RewriteMap    hosts-deny  txt:/path/to/hosts.deny
 217 RewriteCond   ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]
 218 RewriteCond   ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND
 219 RewriteRule   ^  -  [F]
 220 </pre></div>
 221
 222 <div class="example"><pre>
 223 ##
 224 ##  hosts.deny
 225 ##
 226 ##  ATTENTION! This is a map, not a list, even when we treat it as such.
 227 ##             mod_rewrite parses it for key/value pairs, so at least a
 228 ##             dummy value "-" must be present for each entry.
 229 ##
 230
 231 193.102.180.41 -
 232 bsdti1.sdm.de  -
 233 192.76.162.40  -
 234 </pre></div>
 235     </dd>
 236
 237     <dt>Discussion:</dt>
 238     <dd>
 239     <p>
 240     The second RewriteCond assumes that you have HostNameLookups turned
 241     on, so that client IP addresses will be resolved. If that's not the
 242     case, you should drop the second rule, and drop the
 243     <code>[OR]</code> flag from the first RewriteCond.
 244     </p>
 245     </dd>
 246   </dl>
 247
 248 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 249 <div class="section">
 250 <h2><a name="referer-deflector" id="referer-deflector">Referer-based Deflector</a></h2>
 251
 252
 253
 254   <dl>
 255     <dt>Description:</dt>
 256
 257     <dd>
 258       <p>Redirect requests based on the Referer from which the request
 259       came, with different targets per Referer.</p>
 260     </dd>
 261
 262     <dt>Solution:</dt>
 263
 264     <dd>
 265   <p>The following ruleset uses a map file to associate each Referer
 266   with a redirection target.</p>
 267
 268 <div class="example"><pre>
 269 RewriteMap  deflector txt:/path/to/deflector.map
 270
 271 RewriteCond %{HTTP_REFERER} !=""
 272 RewriteCond ${deflector:%{HTTP_REFERER}} =-
 273 RewriteRule ^ %{HTTP_REFERER} [R,L]
 274
 275 RewriteCond %{HTTP_REFERER} !=""
 276 RewriteCond ${deflector:%{HTTP_REFERER}|NOT-FOUND} !=NOT-FOUND
 277 RewriteRule ^.* ${deflector:%{HTTP_REFERER}} [R,L]
 278 </pre></div>
 279
 280       <p>The map file lists redirection targets for each referer, or, if
 281       we just wish to redirect back to where they came from, a "-" is
 282       placed in the map:</p>
 283
 284 <div class="example"><pre>
 285 ##
 286 ##  deflector.map
 287 ##
 288
 289 http://www.badguys.com/bad/index.html    -
 290 http://www.badguys.com/bad/index2.html   -
 291 http://www.badguys.com/bad/index3.html   http://somewhere.com/
 292 </pre></div>
 293
 294     </dd>
 295   </dl>
 296
 297 </div></div>
 298 <div class="bottomlang">
 299 <p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English">&nbsp;en&nbsp;</a></p>
 300 </div><div id="footer">
 301 <p class="apache">Copyright 2009 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 302 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>
 303 </body></html>