Houston...I think we have a hotlinking problem!

[grynmoors]

Hi boys and girls.

The hotlinking thing has been posted to death, but I have to tell you about this one.

I was checking on one of the newer sites I installed recently, for hotlinking. I was wondering if someone can confirm this by testing it also.

I tried every .htaccess method to prevent hotlinking imaginable, yet all the videos I hotlinked to my test site, played using FireFox 3. The videos wouldn't play in IE7, but were playable in FireFox 3.

Any ideas? Can someone confirm this happening to them also?

[bplex]

I have seen something similar before. For me, it turned out that Firefox 3 employs a new caching system which caches FLV video. If you watch the video on your site, the video (along with referrer information) gets cached locally on the computer. Accessing another video (local or remote) bypasses the block because it uses the cached information. The best way to test this out to see if we have a real issue is to setup a video hotlinked from one of your protected sites and then, clear out your Firefox cache, restart Firefox, and try watching the video.

[RAMMSTEIN]

Yes there hotlinking problem is one of the problem that need to be solved. There is nothing that you can do if you have your videos to an other server, you can't add .htaccess method because your videos will not play to your site also with IE. On the other hand firefox 3 do not stop with .htaccess method.

[bplex]

I did some testing and it looks as though Firefox 3 passes referrer information even if you haven't visited the page. I don't know if it works with downloading a video. But it does appear to work if someone plays the video. Time to get to work on a new method, I guess, as anything referrer related is going to be pretty much defeated. Strangely enough, IE 8 appears to do this as well (IE 8 Beta 2). So, whenever IE 8 officially releases, this may become a bigger problem.

[RAMMSTEIN]

Our only hope is here. :o
http://forums.buyscripts.in/viewtopic.php?f=5&t=4241

[grynmoors]

Marvelous. All I want is if someone tried to hotlink and steal my bandwidth, that my site logo appears in the place of the video they're trying to hotlink.

I know there's no way to actually 100% prevent hotlinking but making it easy for people to do it is just stupid.

[bplex]

Yep that is true.

In the other topic above, you can see where I'm at with the whole RTMP streaming and protection thing. Looking good so far. Just a few more items to iron out.

[grynmoors]

Yeppers. Read thru the whole thing.

I'm getting more and more anxious about vShare 2.7. :D Can hardly wait. It was nice to see that ADMIN actually participated in that thread! :D

[bplex]

Yes I agree. I can't wait for 2.7 for a lot of reasons. There is so much that I would like to add that it's not even funny. The lighttpd support is going to be good, especially for performance. However, most users (especially those running deds and VPSs that have panels) will not be able to fully utilize lighttpd as their main and only web server. That's mainly the reason why I'm looking into RTMP.

[admin]

However, most users (especially those running deds and VPSs that have panels) will not be able to fully utilize lighttpd as their main and only web server. That's mainly the reason why I'm looking into RTMP.

If you have two or more IP's on server, you can use on for apache and one for lighttpd, you just need to specify which ip's to be used for apache and for lighttpd.

Listen in apache and server.bind in lighttpd will do it.