Re: serving all images through a file

on 08/04/03 8:03 PM, Burhan Khalid (phplist@meidomus.com) wrote: > If you are doing .htaccess, might as well have .htpasswd authentication. > Excellent tutorials on .htpasswd and other forms of authentication using > PHP can be at Zend ( > http://www.zend.com/zend/tut/authentication.php ) I'm fully aware of what .htpasswd can do -- but the rest of the site relies on session based member management, and I'm not comfortable with managing image based permission on a different system to the rest of the site... seems like a quick fix to me. > In theory, it would make your site slow to load, which is a bad thing > for any website, but especially a no-no for an adult site. Yes, but are we talking .00001% slower, or 5% slower. I guess I'll probably have to measure this myself, unless someone else has got some figures on hand -- or even a good guess. > One thing I > would suggest is hotlink protection on your image dir for the image > extensions. Along the same lines, a simple thing you can do it rename > your images to some obscure extension .. like zbf. This will deter > people from farming your server for images. All you'd have to do is > adjust the Add-Type line in Apache so it serves zbf as gif, etc. I'm not into security through obscurity at all. I'm into making the right decision first time around. If I deny all direct access to these files via http (or even store them outside the docroot), then there is zero chance of harvesting, link sharing, etc. ... but thanks for the chat anyway :) Justin