# Is 'HotLink Protection' fail-safe? **URL:** \ **Category:** Factual Questions\ **Created:** [October 11, 2004, 7:25pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691 "2004-10-11T19:25:41Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Duderdude2](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Duderdude2](https://boards.straightdope.com/u/Duderdude2)\ **Post date:** [October 11, 2004, 7:25pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/1 "2004-10-11T19:25:41Z")
My server provides a service known as “HotLink Protection”. Apparently, it prevents people from accessing my website’s files unless they were directed to the file by my website itself. This would be perfect for what I’d like to do: prevent people from accessing movie files directly from my server (so they can’t share the direct url of the file with friends, etc). Preliminary tests, performed by myself, indicated that this tool works perfectly. However, I just want to confirm with anyone who has more experience than me, the effectiveness of this tool. Are there any ways around this protection, or is it completely reliable? Thanks! ---
**Author:** ![Q.E.D](https://avatars.discourse-cdn.com/v4/letter/q/51bf81/32.png) [@Q.E.D](https://boards.straightdope.com/u/Q.E.D)\ **Post date:** [October 11, 2004, 7:30pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/2 "2004-10-11T19:30:09Z")
It works by looking at the HTTP\_REFERRER environement variable, which tells the server the address of a referring clicked link. Since there’s no way (that I’m, aware of) to spoof this externally, it’s about as secure as it’s possible for anything on the internet to be. ---
**Author:** ![Duderdude2](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Duderdude2](https://boards.straightdope.com/u/Duderdude2)\ **Post date:** [October 11, 2004, 7:34pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/3 "2004-10-11T19:34:59Z")
> [@Q.E.D.](#): > > It works by looking at the HTTP\_REFERRER environement variable, which tells the server the address of a referring clicked link. Since there’s no way (that I’m, aware of) to spoof this externally, it’s about as secure as it’s possible for anything on the internet to be. Well, even if there is a way, as you’re unaware of it, I bet most others would be too. Thanks for the prompt response, sounds like this is exactly the feature I was looking for. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [October 11, 2004, 7:44pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/4 "2004-10-11T19:44:24Z")
I’m no expert on HTTP, but I can’t imagine that spoofing the HTTP\_REFERRER would be all that hard to do, but it would require an application other than any of the internet browsers I know of. And that still leaves the question of why anyone would do that just to get at your stuff. I wouldn’t worry too much about it. ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [October 11, 2004, 8:51pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/5 "2004-10-11T20:51:51Z")
On the one hand, spoofing the HTTP\_REFERER [sic] field is in principle an incredibly easy thing to do. On the other hand, if a person is using IE, or some other browser where they don’t have access to its source code, I don’t know an easy way they could spoof it. So 99%+ of all folks on the internet won’t be able to subvert your protection, and 99%+ of the remainder probably won’t give a damn. Don’t worry about it. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [October 11, 2004, 9:12pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/6 "2004-10-11T21:12:01Z")
You can spoof the HTTP\_REFERER with [wget -referer=URL](http://www.gnu.org/software/wget/wget.html), among others. But, as others have pointed out, most people won’t bother. ---
**Author:** ![Duderdude2](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Duderdude2](https://boards.straightdope.com/u/Duderdude2)\ **Post date:** [October 11, 2004, 9:19pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/7 "2004-10-11T21:19:13Z")
> [@iamthewalrus(:3=](#): > > You can spoof the HTTP\_REFERER with [wget -referer=URL](http://www.gnu.org/software/wget/wget.html), among others. But, as others have pointed out, most people won’t bother. What if the downloads cost, say $1 each. What I’m trying to do is protect the files from people who haven’t made the purchase from downloading them, thus they would have a slight incentive to use such programs. Do you guys think this is a problem? ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [October 11, 2004, 9:47pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/8 "2004-10-11T21:47:58Z")
So… you’ve set up some page you can only get to with a password or something, and from there link directly to said files? That doesn’t sound like a very good idea. Spoofing a referrer agent string is trivially easy (I often download files to my linux box using wget after obtaining the URL from a Windows machine, and sometimes have to do this). Depending on the technical sophistication of your target audience it may work for you, (I don’t think I know of any site where individual files are accessable this way, but if I did, I don’t think it would occur to me to even give that a try) but I’d look in to some other method of properly password protecting the files in question. ---
**Author:** ![Duderdude2](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Duderdude2](https://boards.straightdope.com/u/Duderdude2)\ **Post date:** [October 11, 2004, 9:54pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/9 "2004-10-11T21:54:35Z")
Well, I’m trying to figure that out. How else can I protect them? Even if people were to spoof the urls, they wouldn’t know what the url was until they purchased the movie (or heard from someone else who purchased the movie). ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [October 11, 2004, 10:28pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/10 "2004-10-11T22:28:29Z")
Ah, now that’s quite a different kettle of fish to fry. Or something. Preventing people from stealing stuff that you put out on the web is a hard problem. If you’re charging people to view your content, then the number of people interested in circumventing your security skyrockets. You might try using secure http (https) connections in combination with cookies to verify that a particular client should be allowed access to a particular document. While that secures things on the server side better than using the referrer value, there are still ways to circumvent that. This is not even taking into consideration that once someone downloads a given document, there is nothing to prevent that particular document from being forwarded to others. There are plenty of companies who spend millions of dollars, if not billions, in an attempt to secure digital data. They are mostly successful. That means that they partly fail. You have to gauge how valuable a given dataset is versus how much it would cost to raise the security around it. ---
**Author:** ![Dog80](https://avatars.discourse-cdn.com/v4/letter/d/6bbea6/32.png) [@Dog80](https://boards.straightdope.com/u/Dog80)\ **Post date:** [October 11, 2004, 11:59pm UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/11 "2004-10-11T23:59:22Z")
> [@Q.E.D.](#): > > It works by looking at the HTTP\_REFERRER environement variable, which tells the server the address of a referring clicked link. Since there’s no way (that I’m, aware of) to spoof this externally, it’s about as secure as it’s possible for anything on the internet to be. That’s one way to do it. The other way is to “hide” the video’s URL by passing the download request through a script. There are several levels of script sofistication; some can be opened with an editor and the real address revealed, some are more resistant to attacks. A windows program that can spoof Referer tags is the [HTTP Interceptor](http://www.siliconwold.com/interceptor/interceptor_home.htm), ---
**Author:** ![Duderdude2](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@Duderdude2](https://boards.straightdope.com/u/Duderdude2)\ **Post date:** [October 12, 2004, 12:33am UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/12 "2004-10-12T00:33:33Z")
How can I hide the video urls? Currently, since I’ll be starting small, I’m not too concerned about people stealing the movies (though hopefully it won’t be a huge amount) as it’ll be additional advertising for my site. ---
**Author:** ![chrisk](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chrisk](https://boards.straightdope.com/u/chrisk)\ **Post date:** [October 12, 2004, 12:39am UTC](https://boards.straightdope.com/t/is-hotlink-protection-fail-safe/268691/13 "2004-10-12T00:39:37Z")
I’ll just add this one piece of anecdotal evidence… Years ago I was running a website and put in an HTTP\_REFERRER check to make sure that images did not show up unless they were embedded in or linked to a page on my site. One of my close friends complained that the images were not showing up for her… I did some logging tests and found out that her browser was not sending anything for the HTTP\_REFERRER header at all - either for embedded images or, IIRC, for linked documents. We never did figure out why. She was using internet explorer. I ended up modifying the check to read ‘if HTTP\_REFERRER is from my website or the userID cookie is 22 then show the picture.’ 🙂 (Where that was her userID.)