php - How to prevent website images from being viewed

Question

Make a website, upload a picture to a certain location on the server, and then directly access the picture through a link. This means that when others get the link, they can directly enter the absolute path in the browser to see it. How can it be prevented?

Answer 1

The poster can try out the cloud storage of Youpaiyun. It has Token anti-leeching to solve the problem you mentioned. This article is provided to help you understand Token anti-leeching.

Recommended article: Detailed explanation of Token anti-leeching

Answer 2

Renovate the picture server so that the picture folder is not directly exposed to the outside world. Set up an Http proxy service on the image server. The URL to access the image must have a legal token parameter to allow access, such as http://www.imgserver.com/test.jpg?t=xT5112XabseFg0,

• The t parameter is generated by the encryption algorithm you set yourself, and it contains the creation time of this parameter.

• After receiving this request, the server decrypts the token and gets the timestamp inside. If it was created within 10 seconds (you can set the validity period you want), it returns the image information, otherwise access is denied.

Such an image link has the concept of validity period. When you use it, you can load the image with legal t parameters and display it to the user normally. At this time, the user copies the image address and directly accesses it in the browser. It is likely that the validity period has expired and naturally cannot be opened.

In addition, there is a simpler method to prevent hotlinking: (of course it can also be used in combination with the above method)

Determine the referer information sent by the http request. If it is not equal to your own website domain name or is empty (that is, the image request is not initiated on your website), then access is not allowed.

Answer 3

1. The stupidest way is to encrypt the image file name, which cannot prevent the link from being stolen
2. Use base64 to load the image
3. Access outside the middleware setting method

Answer 4

Search for image hotlink protection, there is too much to say about this aspect.

Answer 5

This kind of demand is better solved with picture anti-hotlinking technology.

Answer 6

You can try the object storage function of the cloud platform. Alibaba Cloud and Qiniu both have them. The permissions for uploading and downloading are separated, or there are also relatively traditional functions such as anti-leeching.

Answer 7

Understandthinkphp5, why does he put the entry file in the public directory?

Because this can ensure that the resources in your project, such as pictures, cannot be directly accessed by the browser, and can only be accessed through a single entry file index.php, so that your pictures or certain code files cannot be directly accessed!

You can follow this idea and set access permissions so that image resources can only be accessed through the entry file

Answer 8

Pictures are uploaded for people to see. I guess you want the anti-theft company. When turning on the anti-theft connection, you can usually check the referer and choose to disable the empty referer. Of course, we must completely guard against theft. You can use methods such as not disclosing the real address, or adding a token.

Answer 9

If the http server you use is apache, then create a new .htaccess in the image directory and write the following code:

<ifmodule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !abc.com [NC]
RewriteRule .*\.(jpg|png)$ http://localhost/ [R,NC,L]
</ifmodule>

The principle is to use the rewrite function of apache to determine whether the referer comes from abc.com, and if not, jump to localhost.
If the picture is accessed directly, there is no referer. If it is referenced from other websites, the referer is the domain name of the other website. Access is not allowed, which can achieve the effect of protecting the image and saving traffic.

Answer 10

I just want to say, why not put it on the server! Just put it up and watch! What the hell is anti-hotlinking, it’s good enough to prevent newbies!