Search code examples
iishotlinking

IIS 10 - ULR Rewrite rule for stopping Image Hotlinking - when working also affects the domain host itself


Windows 2016 Server running IIS 10 with the URL Rewrite Module installed.
The servers are set up in a server Farm.

I've been messing around with this for the last 48 hours and cannot, for the life of me, figure out why it is not working as it is supposed to work.
I've looked at a video showing how to set it up and how it works, and I've mimicked what was done in the video, and nothing, still cannot get it to work.

This is what happens.
Using this code below will work; as you notice, it has the pattern="Pattern: " However, the leading site that hosts the images has its images replaced with the stop-hotlinking.png image as well. So, in theory, it works, but the hosting site has no access to its images to display.
If I remove (pattern="Pattern: "), it does not work.

To sum it up. The below code will display the "stop-hotlinking.png" image on all outside sites, as well as the hosting site.

 <rewrite>
    <rules>
        <rule name="STOP-Hot-Linking" enabled="true" stopProcessing="true">
            <match url=".*\.(gif|jpg|png)$" />
            <conditions>
              <add input="{HTTP_REFERER}" pattern="Pattern: ^$" negate="true"/>
              <add input="{HTTP_REFERER}" pattern="Pattern: ^https?://(www\.)?domain\.com/.*$" negate="true"/>
            </conditions>
            <action type="Rewrite" url="/graph/stop-hotlinking.png" />
        </rule>
    </rules>
</rewrite>

I even tried it with the pattern as this, and it will display the stop-hotlinking.png on all sites including the hosting site.

<add input="{HTTP_REFERER}" pattern="^http://(.*\.)?domain\.com/.*$" negate="true"/>

Solution

  • I was assisted on another forum, and this was the issue.
    I was testing the same image on multiple domains we own.
    And that was the biggest problem, was the image would get cached, even when Google Tools was open, it would still cache it for whatever reason, we never could figure it out. I changed to another image from the hosting site, and it started working.
    We also found out that Google Chrome needed a referral meta tag in the head of the hosting sites page.

    <meta name="referrer" content="origin">
    

    Once all the above was taken care of and the following code in place. It started working.

    <rule name="Prevent Image Hotlinking" enabled="true" stopProcessing="true">
    <match url=".*\.(jpg|jpeg|png|gif|bmp)$" />
    <conditions>
       <add input="{HTTP_REFERER}" pattern="^https?://(www\.)?(?:DomainOne\.com|DomainTwo\.com|DomainThree\.com)/.*$" negate="true"/>
    </conditions>
    <action type="Rewrite" url="/graph/stop-hotlinking.png" logRewrittenUrl="true" />
    </rule>
    

    In the above, you will see there are multiple domains, this is to allow images to be hosted on their domains, and all other domains will get the STOP image.

    This is completed.
    I want to think Jalpa for trying to assist.
    And gr8gonzo from the other forum for helping me out in this long venture.