0

I have an online photo archive. My webpage is password protected but I have not yet protected the photo folder to stop people direct linking the photos by URL. All the photos are uniquely named so it is a little hard to guess... but if somebody wanted to guess, they can - and I don't want them to.

How can I stop them from doing this? Is there a way to show a custom webpage if they do try this, that's says "Oi, don't steal!" or similar?

I have a windows dedicated server with administrator access via remote desktop. The only thing that should enter that folder is a script, nothing else.

Many thanks

TheCarver
  • 19,391
  • 25
  • 99
  • 149
  • Why not also password protect the photo folder? – Greg Hewgill Sep 19 '11 at 20:42
  • I don't know how you might do it with your server configuration, but you said "not yet protected the photo folder" which I thought might imply that you knew how but hadn't done so yet. – Greg Hewgill Sep 20 '11 at 03:07
  • If I knew how, there would be no question :) – TheCarver Sep 20 '11 at 18:03
  • How did you password-protect your webpage? Can you password-protect your photo folder in the same way? (I'm afraid I'm not familiar with exactly how you can tell Windows HTTP servers how to do password protection.) – Greg Hewgill Sep 20 '11 at 18:13
  • Using ASP, if username and password is successful you get access to my page but when you're inside, you can direct link the photos folder – TheCarver Sep 20 '11 at 18:16
  • Oh, you're using non-HTTP authentication. Perhaps you could consider using HTTP-based authentication, which would allow you to protect both the webpage and the photo folder with the same password. – Greg Hewgill Sep 20 '11 at 19:01

2 Answers2

0

Do you mean to say you have enabled basic authentication on the folder containing the images? If that is the case no user should be able to guess, or browse the directory contents without putting in username and password first, otherwise they will get a 401 unauthorized error.

Homan
  • 25,618
  • 22
  • 70
  • 107
0

You can check the referrer. It can be easily defeated but most people likely wont care enough to do so. Here is some more detail about that http://davidwalsh.name/prevent-image-hotlinking

For password protecting a portion of your website you can also use .htaccess files - http://weavervsworld.com/docs/other/passprotect.html

I dont know how to do either of these in IIS, apologies.

Collin
  • 437
  • 3
  • 6