Deny Access to directories from unauthorized users

Question

I am not being paid for this and I would like to know the quickest way to do the following. A former client has a page which only members can access. This page links to a number of galleries which he only wants members to access. The galleries are not protected by any kind of authentication.

What I assume is the quickest way to do this is to create a .htaccess file which only allow people to view the site when the come from a certain referrer. Would this work?

My current thinking is that I could use a php script to deploy a .htaccess file into each of the gallery directories. (There are around a 100 at the moment.)

I found this link which might be what I am after but to be honest I really don't get it. Is my thinking sound?

Answer 1

If you are willing to go down the PHP road why not consider recommending an existing gallery application like Gallery2 or Coppermine, or building some basic authentication with cookies to manage access?

Answer 2

Yes, using a .htaccess file is a good idea, but making exceptions for all of the IP addresses and/or URLs that his members could possibly come from is going to be a pain.

Just tell him to have them use a password, and setup the .htaccess file in conjunction with a .htpasswd file.

.htaccess How-To on Apache.org

.htpasswd on Apache.org

Answer 3

What I assume is the quickest way to do this is to create a .htaccess file which only allow people to view the site when the come from a certain referrer. Would this work?

Not always, no. Not all browsers submit the HTTP Referer field, and some firewalls even remove it. Your biggest issue will be that, if you add it, you'll get sporadic complaints and that'll be hard to investigate unless you have logs to hand that include the referring page.

This page links to a number of galleries which he only wants members to access.

However you verify if a user is a member, is how you protect your gallery.