htaccess....Is there a better way?

Posted: Wed Feb 08, 2006 8:27 pm

Greetings All Knowable Folks,
I have a couple servers. On one of them I have a bunch of stuff that is "extra" stuff for my sites. Interactive Maps...Forecasting tools...downloads....that sort of stuff.

One of my members tonight directed me to another website that has I-Framed one of my Interactive Maps. I wish to block any and all servers from reaching any content from this server with the exception of sites I own. As far as I m concerned....there is noone in the world thathas any business on this server unless they come through an I-Frame from my sites. I would just assume ban the entire world except my sites and ME of coarse from accessing this server.

This brings me to htaccess. I have used tons of htaccess files over the years but never for something like this and I just want to make sure I do it right.....so of coarse to came to right place.

I did some reading....and there is tons on hotlinking and such but none that are really about what I am trying to do. Is this the way I want to do this or is there a better way.

Code:




<Limit GET>


order deny,allow


deny from all


allow www.mysite.com


</Limit>

Thank You for your time!

Dawg

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Have you tried it? There are other ways, for example, to stop iframes.

Posted: Wed Feb 08, 2006 8:34 pm

The I-Frames are only one issue. I want to BLOCK everyone....except me and my admins and my sites.

Everyone else.....has no business on this server.

Dawg

PS...No I have not tried it yet. I wrote the admin of the other site a polite letter to stop it....but this just brought the issue to the forefront. So I figured I would fix it once and for all.

Posted: Wed Feb 08, 2006 8:38 pm

Including RSS feeds?

Posted: Wed Feb 08, 2006 8:59 pm

Yep....There is nothing fo RSS on this thing....

Dawg

Posted: Wed Feb 08, 2006 9:03 pm

In that case, .htaccess might be the best way.

Posted: Wed Feb 08, 2006 9:09 pm

Is there anything else I need to add to the code above to do the job?

Like I said....There are not many people looking to do this sort of thing so there is very docs out there about it.

Dawg

Posted: Wed Feb 08, 2006 9:13 pm

I think not. REALLY nice site, btw. Class all around.

Posted: Wed Feb 08, 2006 9:21 pm

Thank You kguske, You guys have helped a LOT along the way.

Dawg

Posted: Wed Feb 08, 2006 9:33 pm

Maybe, but MAN, you put some work into THAT!

registered · Posted: Thu Feb 09, 2006 5:40 am

Dawg, you could also add some javascript to your includes/javascript.php script to do something like this:

if (self.location != top.location)
top.location.href = 'www.yoursite.com';

This very simple javascript check should wipe out anybody's ability to iframe your site. Try it and see if it works... Wink

Posted: Thu Feb 09, 2006 5:49 am

I Love This Site!

Montego,
I put that in this morning. Thank You.

I have not done the htaccess yet. I have a couple things I need to move off that server first but it is coming in the next couple days.

Thanks Guys!!!

Dawg

Posted: Thu Feb 09, 2006 5:51 am

Posted: Thu Feb 09, 2006 6:18 am

Montego,

That knocked it off-line.....

I will have a closer look at it later this morning...

Dawg

Posted: Thu Feb 09, 2006 6:53 am

Dawg, you have to get the code right Wink

Sorry, should have provided the complete solution, including accurate j avascript code. Try this in javascript.php:

echo "<s cript type=\"text/j avascript\">\n";
echo "\n";
echo "</s cript>\n\n";

Obviously, you must make the s cript tags right...

This is working on my test domain. Also, go to that other site and check out the iframe after you add this code... they will be in for a surprise!

Posted: Thu Feb 09, 2006 6:58 am

LOL.....I kind of figured that was what the deal was. I am about to walk out the door to take my kids to school.....figured I would dig into when I got back. Thank You for the help!

Dawg

registered · Posted: Thu Feb 09, 2006 8:03 am

Javascript will only go so far. All someone has to do is disable Javascript in their browser.

Another approach is to use phpNuke's functions to check for a valid user - the is_user() function

Posted: Thu Feb 09, 2006 12:59 pm

evaders99, that is an interesting thought! However, if I take that through to its logical conclusion, are you sure that you would want to stop ALL anonymous access to your site?

I'll have to mull that one over... it is definitely an interesting approach idea...

Posted: Thu Feb 09, 2006 1:24 pm

I do not wish to stop anonymous traffic....just traffic that comes from outside my site. Here is the deal.....Incorporating these widgets (mapserver, forecasting tools...etc) is WAY to much of a pain in the.....to do it through Nuke. So what I have done is create an Iframe in a Module and that is how the widgets are accessed. For the most part they look and feel just like they are part of the site. Am I wrong in saying that it is my domain server (where my main site is) that is calling the data from the widget server? So I simply need to allow access from my main domain. RIGHT?

Dawg

Posted: Thu Feb 09, 2006 5:20 pm

Your server doesn't call anything. Using an iframe still relies on the client machine to load the page.

Iframe isn't a solution if you really want it integrated into your site. You have to integrate the code somehow. Using include, you could create a PHP script wrapper for that content and place it in a phpNuke module. It should work better than iframes for security

Posted: Thu Feb 09, 2006 5:47 pm

Evaders, Do you know of a wrapper that I could look at as an example?

Dawg

Posted: Thu Feb 09, 2006 6:24 pm

Also a question....How about referrers....Does an I-Frame generate a referrer and could i use that referrer to allow access?

Just a thought...

Dawg

Posted: Thu Feb 09, 2006 9:00 pm

Look at the NukeWrap module for an example of an iframe. It's not referers (yes, it's correctly spelled - because the people who coined the term mispelled it) you want to block - that's just other websites that link to yours. You've been talking about people who direct-link your content, which your htaccess code should handle.

Posted: Fri Feb 10, 2006 1:21 am

I just wanted to have my 2 cents on this as I have just got home and I want to upset the apple cart.
Why not, instead of looking at solutions completely block external sources from grabbing your data, why not make something of the situation - redirect them to a page of google ads instead!

Posted: Fri Feb 10, 2006 2:04 pm

Quote:

Why not ... redirect them to a page of google ads instead

Because that would be against Googles TOS Smile