« Obama Tzar Waves His Scepter | Main | Jersey Shore Poll: Where Should Season Two Take Place? »

February 4, 2010

Firefox Ignores Apache Mod_Rewrite Hotlink Redirects

I could not figure out why Firefox was ignoring my Apache redirects. I could not figure it out. I just couldn't get it. IE worked fine. It followed my Apache redirects to prevent image hotlinking. It didn't matter where I put the .htaccess file. I tried putting .htaccess in the root. Tried putting it in the image folder. It didn't matter.

I tried testing the hotlinking functionality so many different ways. I tried using this site and this site to hotlink to one of my images. I asked Uzi to hotlink one of my images from his site. I tried hotlinking to one of Uzi's images with my site (with his permission).

If I used IE, everything worked fine. Apache redirects worked flawlessly with IE. The IE requests were redirected to the "hotlink" image, which says, essentially, "stop stealing my bandwidth". But for Firefox, it would show the hotlinked image. It made me want to start killing strangers. Maddening. I could not figure it out. Nothing made any difference.

My apache mod_rewrite commands:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?peeniewallie.com [NC]
RewriteRule \.(jpg|bmp|png|gif)$ http://www.peeniewallie.com/imagehot/pw.jpeg [NC,L]

These worked flawless for IE and for Chrome. They would not work for my 2 of my desktops running Firefox. To make matters worse, I was running two different releases of Firefox on the desktops. Firefox 3.5.7 on one desktop. Firefox on the other desktop. Neither of them worked. Both of the desktops running different versions of Firefox were able to successfully hotlink to my images all day long. Arrghh.

Then, I tried my laptop. Surfing the internet wirelessly, I was able to get Firefox on the laptop (Version 3.5.7) to follow the Apache mod_rewrite redirects successfully. It successfully redirected to the "hotlink" image. So, I thought, maybe it was because of the way I was connected into the network. Maybe the fact that I was coming into the network wirelessly somehow made a difference. So, I connected the laptop directly into the network with ethernet Cat 6 cable and turned off my wireless card. Still worked the same. No change in performance. Firefox works fine on the laptop...it follows the Apache redirects. The two desktops with Firefox ignore the Apache redirects all day long.

Then, I decided to try another desktop. (I'm not going to lie to you - I've got a lot of computers at the house. More than I can manage, obviously.) On the third desktop, Firefox (Version 3.5.7) performed properly....it followed the Apache redirects, as did the laptop.

So, now I'm trying to figure out what's going on. I'm starting to paint this issue into a corner. Basically, the only browser that has any issue at all out of IE, Chrome, and Firefox - is Firefox. And it's only a problem on 2 out of 4 computers. The clot thickens.

So, I'm hammering away on these two desktops, trying to figure out why they will hotlink images that no other browser on earth will hotlink, when I realize that part of my problem is related to cache. Now, every time I attempt a hotlink test, I delete all of the cache files in Firefox. But, for some reason, when I stop my apache web server, this website still shows a valid hotlink to my image. But, now I know it's lying to me because Apache's shut down. So, I know I have a cache issue. Gradually, I realize that Firefox 3.x doesn't handle cache files very well. I finally solve this issue by typing in "about:config" into the address bar and changing the setting "browser.cache.disk.enable" to "false" and setting the "browser.cache.check_doc_frequency" = 1. Basically, this means...."Dear God Please Stop Caching Files!" (This was not previously a problem with FireFox, but starting with release 3.x, it became a problem.)

So, now, at least, I'm not fighting with Firefox's faulty cache issue any more. That problem is out of the way. Still, I mean, certainly we do still have a major hotlink issue, but at least we know what we're dealing with, at this point. I'm not getting feedback from 3rd party websites that they can hotlink to my images when my webserver is down. We're past that, anyway.

I have spent some time digging through my Apache log files. I've done that. And I have noticed that I have a slew of "blocked referrers" in the log. Now, I'm not clear why this is. But I have noticed it. I've stumbled across a few websites that talk about blocked referrers and how that can occur. Apparently, it can be caused by a variety of issues including, but not limited to, typing in the URL directly, following a bookmark, 3rd party software, etc, etc.

I had some idea that, perhaps, my issue was related somehow to blocked referrers. I even convinced myself that AVG was blocking my referrers. Maybe the AVG LinkScanner, or the ActiveShield, or something else. I uninstalled AVG, but still, I had the problem where Firefox is hotlinking to images on 2 of my desktops.

And, I find myself in this odd position of trying to fix my 2 Firefox installs so that they won't hotlink my images. But, obviously, this makes no sense. I mean, OK. So, let's say, for argument's sake, that I uninstall and reinstall Firefox and it works. These 2 installs of Firefox start performing better, and they follow my Apache redirects. What then? I mean, the fact they they're showing hotlinked images right now is a huge, glaring problem. And fixing Firefox isn't necessarily the answer. Sure, I can probably make Firefox quit hotlinking my images, but what then? Aren't I really just papering over a glaring problem - namely that others out there could be (and probably are) hotlinking to my images right now?

But this is where I am. For now, I'm trying to fix Firefox. Trying to paper over this little problem. Trying to solve one issue at a time. And I'm thinking....Firefox...Firefox....blocked referrers....why would Firefox be different on these two computers. And then, it hits me. Out of the clear blue sky it hits me like a ton of bricks. Crazedlist. Not Craigslist.org. Crazedlist.org. Search Craiglist like a madman. But, before you can, you have to do a little trick. You have to go to "about:config" and change the "network.http.sendRefererHeader" variable from a "2" to a "1". Voila. That was it. On the two desktops, I'd reconfigured Firefox not to send Referrer Headers. So, I was blocking my "referrer" headers on my http requests with those two installs of Firefox. Because the http requests came in without any "referrer headers", they were not blocked. Now, certainly, you can configure the Apache mod_rewrite so that you redirect the blocked referrers, but there are apparently a few arguments against it.

I've not decided how I'll change my Apache Mod_Rewrite directives just yet. RIght now, I'm happy that I've solved the mystery of why Firefox appeared to be ignoring my Apache redirects. OK - technically, it wasn't ignoring my redirects, but it was blocking my http referrer headers without my knowledge, which cause the browser to behave in a counter-intuitive manner. :)

Posted by Rob Kiser on February 4, 2010 at 2:33 PM


does anyone read this stuff. my head is hurting me.

Posted by: mop on February 4, 2010 at 7:49 PM

Mainly, I write it for myself. I use the website as a searchable online database, so when I have problems in the future, I just search my website for the details. I have to write it all down when it's clear in my head because, a year from now, I won't remember what I did.

The funny thing is that, occasionally, others do claim to find some of the posts useful. Like, for instance, I posted this today, and if you google for Firefox Ignores Apache Redirects, my site comes up first now.

So, possibly someone will find it useful in the future. Possibly not. Hard to say.

I posted this techie gibberish 5 years ago, and I still have people posting telling me that I saved their @ss with this one: http://www.peeniewallie.com/2005/04/data-recovery-i.html

Posted by: Rob Kiser on February 4, 2010 at 9:57 PM

good point. each time I mess with my modem, its the same thing, trying to remember what I did last time.

Posted by: mop on February 5, 2010 at 7:52 AM


Posted by: Calumks on March 7, 2010 at 11:47 AM

Hey man, I do the same thing with my site (keep an online journal of what I've done to fix things)

I just wanted to post to say, "Yes! Some people read this stuff." :)

It hurts my head too. It's nice to know I'm not the only one with a throbbing noggin trying to figure out this crap.

Posted by: Mike on March 31, 2010 at 4:01 PM

I am using the following code
#Stop Image Hotlinking
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http(s)?://(www.)?mysite.net [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !google. [NC]
RewriteCond %{HTTP_REFERER} !search?q=cache [NC]
RewriteCond %{HTTP_REFERER} !msn. [NC]
RewriteCond %{HTTP_REFERER} !yahoo. [NC]
RewriteRule .*\.(jpe?g|gif|bmp|png)$ – [F]

Its strange that the image is not hotlinking on IE but on firefox it loads, what exactly is the problem ?

Posted by: Val on May 26, 2010 at 9:13 AM

My conclusion from this and other problems: Right now, Webkit (Chrome and Safari) are the best desktop browsers available. Firefox is next, followed by Opera, and, of course, IE is in last place.

The Webkit Browsers just seem to be the most advanced (CSS3 functionality, Animations, etc.) and predictable of the browsers.

Firefox and Opera both seem to have more of these little quirks or bugs.

Posted by: Karl Kelman on July 10, 2012 at 1:37 PM

Thank you thank you thank you. You have just saved me countless hours and headaches. I, too, had network.http.sendRefererHeader set to 2 in about:config.

Why did I do that? WHEN did I do that? Maybe Firefox did it themselves in an update? I don't know.

All I know is that I'm so glad you managed to figure it out and that you posted about it.

I am NOT trying to double-post, but my first one told me I failed to enter my name and email, so I'm dutifully trying again. Please do not kill me.

Posted by: Leslie on December 18, 2012 at 7:26 AM

Post a comment

Remember Me?

(you may use HTML tags for style)