Caddy: hot link protection ?

[centminmod]

Does Caddy support hotlink image protection ? What about with replacing the hotlinked image with custom image ?

cheers

George

[mholt]

Hm, this basically means doing a URL rewrite based on the Referer header, right?

This isn't currently possible, but I have some ideas for rewrite middleware (or maybe another) to make this possible.

[centminmod]

yeah basically a rewrite based on referrer header and/or checking against valid referrers that are allowed http://nginxlibrary.com/hotlink-protection/

Would be nice to have :)

Not sure how involved it can be. For example with Nginx and Nginx lua, you can do some Lua checks for referrer and useragent and map them to variable so if a specific referrer or useragent is detected, you can allow or disallow hotlinking of the url.

[captncraig]

This would be a really simple plugin to get your feet wet extending caddy. See https://github.com/abiosoft/hello-caddy for a nice getting-started guide.

[mholt]

I agree -- let's open this to someone who would like to write their first Caddy add-on. It should be as simple as checking the Referer header and responding with a different status code, rather than passing the request on through the middleware chain.

[mholt]

Actually, I may be getting ahead of myself. Recent upgrades to the rewrite middleware make this possible, at least for simple protections:

rewrite {
    if {>Referer} not mysite.com
    status 403
}

[humboldtux]

@mholt I can work on this if you still think it needs an add-on.

[mholt]

Does the rewrite middleware suffice? The upgrades to it in 0.8.1 are pretty baller, and should capable of hotlink protection.

[mholt]

Well I haven't heard anyone complaining about the rewrite middleware not being sufficient, so I assume it is :smile: Closing in favor of that.

[pbuzdin]

2016/12/26 21:22:09 Caddyfile:22 - Parse error: Wrong argument count or unexpected line ending after 'status'
via https://github.com/mholt/caddy/issues/402#issuecomment-172418928

[mholt]

@pbuzdin You now have to use the status directive.

[aydos]

i got the same error with pbuzdin

http://test.local {
    rewrite {
        if {>Referer} not test.local
        status 403
    }
}

2017/01/29 22:23:48 /etc/caddy/caddy.conf:60 - Parse error: Wrong argument count or unexpected line ending after 'status'

How can I use 'status' directive?

[aydos]

@pbuzdin i think this will work:

http://test.local {
    root   /var/www/test/
    rewrite {
        if {>Referer} not ""
        if {>Referer} not "http://test.local/"
        to /hotlink 
    }
    status 403 /hotlink
}