darkwing / blog

Repository to allow bug tracking of davidwalsh.name
4 stars 0 forks source link

Link to HTTPS in hotlink.js and RewriteRule #49

Open Malvoz opened 6 years ago

Malvoz commented 6 years ago

I would assume davidwalsh.name is implementing the same or similar code as in the examples displayed at https://davidwalsh.name/prevent-hotlinking:

.htaccess

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTP_REFERER} !^$
  RewriteCond %{HTTP_REFERER} !^https://davidwalsh.name/.*$ [NC]
  RewriteRule \.(js)$ http://davidwalsh.name/hotlink.js [R,L]
</IfModule>

hotlink.js

window.location="http://davidwalsh.name";

I noticed (while testing to load main.js from a codepen) that the request is blocked due to mixed content:

Mixed Content: The page at 'https://codepen.io/anon/pen/mGQGbg' was loaded over HTTPS, but requested an insecure script 'http://davidwalsh.name/wp-content/themes/punky/js/hotlink.js'. This request has been blocked; the content must be served over HTTPS.

Probably want to use https in both the .htaccess snippet and hotlink.js.

Oh and what a funny and cleaver way to handle hotlinking 😆