I'm working in a password protected directory. "Quicktime" + "Safari" + "AuthType Basic" are doing there best to challenge me (and winning). I've managed to implement a solution via htaccess but I would like to improve the security.
I now have a secure folder with basically public .mov files inside.
I've implemented:
AuthUserFile /var/www/ht/.htpasswdblabla
AuthName Protected
AuthType Basic
require valid-user
Options +FollowSymlinks
RewriteEngine on
<FilesMatch mov>
Satisfy any
order allow,deny
allow from all
</FilesMatch>
What I would like to do is only "satisfy any..." based on a relative request and "require valid-user" for any fully qualified/absolute request. This would allow the pages quictime/video object to access the files freely, but anyone linking to the file would need a password.
../movie.mov (would satisfy...)
movie.mov (would satisfy...)
http://basedomain.com/protected_folder/movie.mov (require valid-user)
Any help or a point in the right direction would be greatly appreciated.
Help me Obi Wan Kenobi, you're my only hope.
If I understand your question correctly, this is not possible. It is possible to write relative links into your code, but the browser is always making an absolute request so it is not possible for Apache to differentiate a relative link from any other.
You might look into allow/deny based on the request referrer. I am not sure how reliable that is, and it could be easily spoofed...but it might prevent casual attempts.
Problem is similar to trying to prevent others from deep-linking your images. There are different strategies, but often more trouble than they are worth.