Redirect from file based on referrer using JavaScript

Question

Versions of this question have been posted numerous times, but none of the solutions I've found on this site have worked so far. I'm trying to redirect away from files, not web pages. I actually need to know if this is even possible, since I learned that PHP is incapable of doing this. Here's an answer from a previous question I asked:

The web server will first check if it exists and if it does, it will serve the file immediately. It does not go through any PHP code. Therefore you cannot write any PHP code that will intercept this request and block it.

We have a folder on our site with a path of /downloads/, containing files we don't want just anyone to download.

I want to put a script in our main JavaScript file that says:

If file is is /downloads/
If user comes from referrer allowed_domain.com, allow access to files in /downloads/
Else redirect to homepage or 404

My attempt (didn't work)

if (top.location.pathname === '/downloads/private.zip') {
  if (document.referrer !== "http://www.allowed_domain.com") {
    document.location.path = "/downloads/private.zip";
  }
  else {
  document.location.path = "/404";
  }
}

Constraints

I cannot use .htaccess. Our hosting provider is running Nginx, not Apache. I've tried using Nginx config code, but I have to send it to them to implement, and it didn't work and they won't help me.

And yes, I know that this is a super, super insecure solution for restricting access. My company is working on a more formal solution, but until then, I need to implement something temporary to deter users who lack the computer knowledge or motivation to get around the redirect, and this is pretty much my last option.

Who told you that quoted statement? It's plain wrong, of course you can configure your web server to involve PHP instead of serving the files directly. And you need to do this on the server side, there is no clientside javascript involved in a document download. — Bergi
– Bergi, Commented Feb 22, 2017 at 23:24
@Bergi are you talking about placing the file outside of public_html and delivering it through PHP? Because I'd love to do that, but my hosting provider doesn't support it. — Jesse
– Jesse, Commented Feb 22, 2017 at 23:27
Yes, something like that, however I can hardly believe nginx wouldn't support this (unless it's an arbitrary restriction imposed by your hoster for your payment category) — Bergi
– Bergi, Commented Feb 22, 2017 at 23:30
@JesseRogers Can you change the directory name or move the files? If so, let PHP deliver those files via index.php?file=myfile.zip while never revealing the directory. — user6702203
– user6702203, Commented Feb 22, 2017 at 23:30
@Bergi I don't think it's that Nginx doesn't support it, but that the company hosting my site's web server doesn't allow it. — Jesse
– Jesse, Commented Feb 22, 2017 at 23:31

AmericanUmlaut · Accepted Answer · 2017-02-22 23:19:04Z

This problem is not solvable in JavaScript, even in the very limited and insecure way that you are proposing. The problem is that a request to /downloads/private.zip directly returns the contents of that file - it doesn't load any HTML page, so the browser will never see or execute that JavaScript code.

A way to solve this would be to have a PHP file that handles any request to that directory, checks whether the user has permission to see those files, and then returns the requested file or a 404. But for that you need some form of configuration, and you've already told us you can't do that either.

A third solution, one that is very silly but would work (for unsavvy users) in this very constrained situation would be to replace all links to the forbidden resources with a snippet of JavaScript that directs the user either to the file or a 404 page. However, from your question it seems very likely that you're trying to prevent access from users coming from sites outside of your control, in which case this won't work either.

Bottom line: This is not a solvable problem if you don't have the ability to configure your web server.

Collectives™ on Stack Overflow

Redirect from file based on referrer using JavaScript

My attempt (didn't work)

Constraints

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

My attempt (didn't work)

Constraints

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related