Member Avatar for arjani10

Hello!I have an problem may be someone can help me about it,I put in folder swf-s and i am protecting them with htaccess. I give access some websites,my problem is to block some urls who are geting iframe embed from website have access.Is possible to block swf players dont appeard in their iframe website?Thank you in advance

  • 2 Contributors
  • 3 Replies
  • 376 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

Short answer: the approach outlined—route SWF requests through a small server-side handler that checks the request origin and then allows or blocks framing—is a valid pattern, but it needs a few practical adjustments and caveats to work reliably and securely.

Key caveats and modern guidance: the Referer header can be absent or forged, and the legacy X-Frame-Options value ALLOW-FROM is poorly supported by browsers. For modern clients prefer a Content-Security-Policy with the frame-ancestors directive where possible. Also note that Flash/SWF is end-of-life in current browsers, so long-term protection usually means migrating away from SWF delivery entirely.

Practical implementation notes and troubleshooting (gaps in the thread):

  • Whitelist entries should be normalized hostnames (no scheme or path). Compare the host portion of the Referer URL against that list rather than doing a raw string match of the full referer value. Decide whether subdomains are allowed and match accordingly.
  • If the handler runs from .htaccess, ensure mod_actions/mod_headers are enabled, AllowOverride permits the directives, the handler script is executable with the correct shebang, and Apache error logs are checked for permission or CGI errors.
  • Decide policy for missing Referer: deny-by-default is safer, or use a second factor (token) to avoid false negatives.
  • Test by inspecting raw response headers (devtools or curl) to confirm headers are present/absent as intended and to verify behavior across multiple browsers.

Stronger options when security matters: use signed, short-lived URLs or a proxy endpoint that serves SWFs only after validating a cryptographic token; prefer vhost-level configuration over .htaccess for performance and reliability; and consider replacing SWF with HTML5/JS players where feasible.

Recommended Answers

All 3 Replies

Member Avatar for cereal

Hi,

I haven't tested this but I think you could use mod_actions with X-Frame-Options SAMEORIGIN, this header is used to define if an external website can include your pages through an iframe. It has three statements:

  • SAMEORIGIN
  • DENY
  • ALLOW-FROM

The third option would be perfect for you but is not supported by all browsers. The actions module instead allows you to run a script when a defined type of file is requested, so, in your case a SWF file. The idea is to check if the referrer is in the whitelist array. If the condition is satisfied we simply set an environment variable (readable by Apache) and block the setting of the X-Frame-Options header.

So, set these lines in the .htaccess file:

Actions application/x-shockwave-flash /cgi-bin/swf.cgi
Header append X-FRAME-OPTIONS SAMEORIGIN env=!SWF_ALLOWED

And, as example of the swf.cgi script, write:

#!/usr/bin/env php
echo "Content-type: text/html\n\n";

$whitelist = array(
    'domainA.tld',
    'domainB.tld',
);

$ref = get_env('HTTP_REFERER');

if($ref && in_array($ref, $whitelist)) 
    apache_setenv("SWF_ALLOWED", "TRUE");

More information here:

Edited by cereal
Member Avatar for arjani10

Thank you for your answer,but is getting error in htaccess. In cgi when can i put websites allowed here?
'domainA.tld','domainB.tld',

Edited by arjani10 because: answer
Member Avatar for cereal

For troubleshooting errors about the script & .htaccess check the Apache documentation, here's the link:

In cgi when can i put websites allowed here?

The content of the whitelist array can be hardcoded (as in my example) or dynamic: let say you use memcached to save the list (through an update script) in RAM and pull it at request or, instead of memcached, you could use a database connection. It's up to you.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.