How to protect your Images folder?

[LarryM]

Hi,

NB, not to stop capturing the single displayed Image, but to stop downloading
the entire image directory.
(In my Website you will do a search, and get some thumbnails, and these can be
enlarged one by one).

This topic seems to be frequent.
Some says that you under no circumstances can protect your images, others seem
to have preventing solutions.
Some says that everything uploaded to your web server can be taken down, others
manage to hide files.

As far as I understand so far I have an idea that the following might work.
Please guide me!

My Web provider has given me a space which has a Root folder, and below it is
the WebSiteRoot, which contains my website. The Root folder should not be
available for Web users. There I for instance put my Access DB (accessed through
ODBC). I have FTP access to this space.

So, I would like to put my Image folder in the Root folder, and have my Provider
make it a Virtual Directory in IIS, with an Alias name, and with No Browse
permissons (I hope that does not stop me from seeing it in my FTP program...),
but Write permisson (for me to upload to it), Read permisson (for the Web to get
the images), and with Anonymous Access set off.

Then I can refer to this Virtual Directory from inside my Website, using the
Alias name.
And in IMG SRC you may see the (alias) URL to this Virtual Directory, but an
outside user should not be able to access it.

Could this stop a user from downloading any images from my Image-folder?
Even if they are using some sort of ripoff utility?

(Or should I have to take a step further and ADO stream the image to the
htm-page through an ASP page in order to hide the URL completely?)

(And also, IF the ASP pages are invisible to the browser - could I hide my
images by renaming my .jpg-files to .asp-files? - I mean, the browser gladly
displays the image even if it is called .asp).

Thanks
Larry

[Evertjan.]

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

NB, not to stop capturing the single displayed Image, but to stop
downloading the entire image directory.

you can fool some people all the time
you can fool all people some time
but ....

Anything that is downloadable into the browser can be copied.

So keeping ALL directories on your asp site non browsable is imperative but
finally security wise useless. Only image files you do not download and
give a unguessable name are relatively safe. However, what is the use
having those on site anyway?
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[LarryM]

On 04 Aug 2003 17:02:23 GMT, "Evertjan." <ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

NB, not to stop capturing the single displayed Image, but to stop
downloading the entire image directory.

Anything that is downloadable into the browser can be copied.

I don't contradict that..

Maybe I was unclear.
The question is if an imagefile displayed in this way is downloadable directly
from the directory?

Larry

[Evertjan.]

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

On 04 Aug 2003 17:02:23 GMT, "Evertjan."
<ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in
microsoft.pub lic.inetserver. asp.general:

NB, not to stop capturing the single displayed Image, but to stop
downloading the entire image directory.

Anything that is downloadable into the browser can be copied.

I don't contradict that..

Maybe I was unclear.
The question is if an imagefile displayed in this way is downloadable
directly from the directory?

Yes, if you know it's name.

You could hinder that by using an .asp intermediate file that looks at the
referrer name, but once displayed in a browser, it has a copy in the
clients tempfiles.
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[LarryM]

On 04 Aug 2003 19:44:59 GMT, "Evertjan." <ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

On 04 Aug 2003 17:02:23 GMT, "Evertjan."
<ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in
microsoft.pu blic.inetserver .asp.general:
NB, not to stop capturing the single displayed Image, but to stop
downloading the entire image directory.

Anything that is downloadable into the browser can be copied.

I don't contradict that..

Maybe I was unclear.
The question is if an imagefile displayed in this way is downloadable
directly from the directory?

Yes, if you know it's name.

Is then also ANY virtual directory (outside the default website) or ANY
directory on the Server Computer open for any user as long as you know or can
guess it's name (and put in an URL)?
Is it just a matter of guessing any directory and filename on a server, and then
you can download it??
You could hinder that by using an .asp intermediate file that looks at the
referrer name, but once displayed in a browser, it has a copy in the
clients tempfiles.

I say it again: This is not about stopping the image once it has been displayed
in the browser, not much you can do about that!
It is about stoppping bulk download of the entire image directory!

So you mean that I have no other option then to go the step which I also
mentioned: ADO stream the imagefile through an asp-file?

/Larry

[Evertjan.]

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

Yes, if you know it's name.

Is then also ANY virtual directory (outside the default website) or
ANY directory on the Server Computer open for any user as long as you
know or can guess it's name (and put in an URL)?
Is it just a matter of guessing any directory and filename on a
server, and then you can download it??

You could hinder that by using an .asp intermediate file that looks at
the referrer name, but once displayed in a browser, it has a copy in
the clients tempfiles.

I say it again: This is not about stopping the image once it has been
displayed in the browser, not much you can do about that!
It is about stoppping bulk download of the entire image directory!

So you mean that I have no other option then to go the step which I
also mentioned: ADO stream the imagefile through an asp-file?

Well, in my rented virtual machine, the cgi-bin is not accessable for
nonexecutables from outer space. so a directory /cgi-bin/images/ is only
accessable though ADO or scripting-host. The same is true for any normal
webside directory, where you can keep the name of secret, as long as you
have http-directory browsing off.

So /images/secretpathqwert y6284675/myimg.jpg is secret as long as you do
not point to it in any clientside script, but use myimg.asp to fetch it.

In myimg.asp I would put something like this:

<%
If request.serverv ariables("http_ referrer")
<>"http://mysite.org/index.asp" Then response.end

Set fs = server.CreateOb ject ("Scripting.Fil esystemobject")
Set pt = Server.MapPath( "/images/secretpathqwert y6284675/")
etc.
%>
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[LarryM]

On 04 Aug 2003 22:15:51 GMT, "Evertjan." <ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

Yes, if you know it's name.

Is then also ANY virtual directory (outside the default website) or
ANY directory on the Server Computer open for any user as long as you
know or can guess it's name (and put in an URL)?
Is it just a matter of guessing any directory and filename on a
server, and then you can download it??

You could hinder that by using an .asp intermediate file that looks at
the referrer name, but once displayed in a browser, it has a copy in
the clients tempfiles.

I say it again: This is not about stopping the image once it has been
displayed in the browser, not much you can do about that!
It is about stoppping bulk download of the entire image directory!

So you mean that I have no other option then to go the step which I
also mentioned: ADO stream the imagefile through an asp-file?

Well, in my rented virtual machine, the cgi-bin is not accessable for
nonexecutabl es from outer space. so a directory /cgi-bin/images/ is only
accessable though ADO or scripting-host. The same is true for any normal
webside directory, where you can keep the name of secret, as long as you
have http-directory browsing off.

So /images/secretpathqwert y6284675/myimg.jpg is secret as long as you do
not point to it in any clientside script, but use myimg.asp to fetch it.

In myimg.asp I would put something like this:

<%
If request.serverv ariables("http_ referrer")
<>"http://mysite.org/index.asp" Then response.end

Set fs = server.CreateOb ject ("Scripting.Fil esystemobject")
Set pt = Server.MapPath( "/images/secretpathqwert y6284675/")
etc.
%>

Thanks Evertjan!
Have I got this right:
If somebody CAN guess that you have a directory
"/images/secretpathqwert y6284675/", is it then open for access
for this person, no matter where the directory is situated?
(I am thinking of outside or inside 'the default webside').
Is it just a matter of knowing the name of the directory to get access to it?

I am glad that you can bear with my questions, it seems to take a long time for
me to understand the systems..
/Larry

[Mark Schupp]

Larry,

The only way that images can be downloaded (bulk or otherwise) is if the
downloader knows the URL to each image. Since you have disabled "browse" in
IIS for that directory there is no way for a download program to reliably
determine the URLs unless you have links to them embedded in a page that the
program could parse to get the paths.

--
Mark Schupp
--
Head of Development
Integrity eLearning
Online Learning Solutions Provider
ms*****@ielearn ing.com
http://www.ielearning.com
714.637.9480 x17
"LarryM" <lm****@telia.c om> wrote in message
news:4m******** *************** *********@4ax.c om...

On 04 Aug 2003 19:44:59 GMT, "Evertjan." <ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in microsoft.publi c.inetserver.as p.general:

On 04 Aug 2003 17:02:23 GMT, "Evertjan."
<ex************ **@interxnl.net > wrote:

LarryM wrote on 04 aug 2003 in
microsoft.pu blic.inetserver .asp.general:
> NB, not to stop capturing the single displayed Image, but to stop
> downloading the entire image directory.

Anything that is downloadable into the browser can be copied.

I don't contradict that..

Maybe I was unclear.
The question is if an imagefile displayed in this way is downloadable
directly from the directory?
Yes, if you know it's name.

Is then also ANY virtual directory (outside the default website) or ANY
directory on the Server Computer open for any user as long as you know or

can guess it's name (and put in an URL)?
Is it just a matter of guessing any directory and filename on a server, and then you can download it??

You could hinder that by using an .asp intermediate file that looks at thereferrer name, but once displayed in a browser, it has a copy in the
clients tempfiles.
I say it again: This is not about stopping the image once it has been

displayed in the browser, not much you can do about that!
It is about stoppping bulk download of the entire image directory!

So you mean that I have no other option then to go the step which I also
mentioned: ADO stream the imagefile through an asp-file?

/Larry

[Bullschmidt]

Serving Dynamic Images from Static Web Pages - 5/24/2000
http://www.4guysfromrolla.com/webtech/052400-1.shtml

Best regards,
J. Paul Schmidt, Freelance ASP Web Developer
http://www.Bullschmidt.com
ASP Design Tips, ASP Web Database Demo, Free ASP Bar Chart Tool...
*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[LarryM]

thanks, all ..
/Larry