How to prevent image hotlink from your ASP.NET site?

Question

What is the best/simplest way to prevent people hotlinking to images from my hosted ASP.NET website? I don't need to prevent all images/resources from hotlinking, I just want to prevent hotlinking to specific images/resources on a site. FYI. It's hostesd on GoDaddy.com so IIS tricks probably wont work.

Answer 1

Simplest way to do this is with a UrlRewrite in IIS 7.0.

https://help.maximumasp.com/KB/a738/using-url-rewrite-to-prevent-image-hotlinking.aspx

<configuration>
<system.webServer>
    <rewrite>
        <rules>
            <rule name="PreventImageHotlinking" enabled="true" stopProcessing="true">


<match url=".*\.(gif|jpg|png)$" />
  <conditions>
                        <add input="{HTTP_REFERER}" negate="true" pattern="^$" />
                        <add input="{HTTP_REFERER}" negate="true" pattern="http://www.YourDomain.com/.*" />
  </conditions>
  <action type="Rewrite" url="/images/hotlinking.jpg" />
</rule>
            </rules>
        </rewrite>
    </system.webServer>

Answer 2

Streaming the images through an ASPX page is a good solution. Though Referrer could be hacked.

What you could do is use a unique salt (keyword) and generate against MD5 (SHA-1 or SHA-2) if you are really concerned with security. Run the current epoch time as well against this as well, this puts an expiry on images as well. Store this "keycode" in the cookies. Whenever images are served you basically pass this via the querystring. The validation happens on the ASPX on the other end. You could even regenerate a new "keycode" between each request using either an HTTPRequestModule or the Global.asax page.

There will be overhead, but it will prevent anyone from hotlinking.