htaccess help - deny direct access to site directories, but still allow file access

[Tennouji]

Hello, I'm a little new on VPS management, and been trying things. To make things short here's what I've done so far:

I have SiteA, and SiteB which is hosted on a different server without any site script, and is just a hierarchy of folders/video files. I've thought that in SiteB I should disable direct access to the directories, while allowing the videos from SiteB be embedded only on SiteA and unable to be hotlinked anywhere else, not even direct access of file from browsers/download accelerators.

.htaccess of SiteB main directory (where the domain is directed)

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://mysite.com/ [NC]
RewriteRule .*\.(mp4|mkv|flv)$ http://i.imgur.com/qX4w7.gif [L]
Options -Indexes

Here's the problem: Using the said .htaccess the the directories/video files returns an error 500 code from browser/download manager access, but SiteA can't play the video files in its video player. I thought that the directory access restriction on .htaccess might be the cause, so I removed it and tested the sites again.

.htaccess of SiteB main directory (where the domain is directed)

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://mysite.com/ [NC]
RewriteRule .*\.(mp4|mkv|flv)$ http://i.imgur.com/qX4w7.gif [L]

What happened is, SiteB index can be accessed again in its domain, and the subdirectories and files in them are able to be seen. SiteA is able to play the video files in its media player, while the direct URL of video files are able to return the image URL(.gif file) when accessed on browser/download manager.

I'll let them as is for now, but I still would want to have SiteB directories inaccessible from prying eyes, since it reveals what contents I have in them. I'd love to hear any solutions to be able to do it. Thank you.

 

[Tango]

HTTP_REFERER is set by browser so its not good to use that method.

I would keep all files out of http on the storage server & use 1 php file to stream them eg. stream.php?filename=movie1.avi and maybe _POST data along with the _GET request to protect it from leeching? or use a common database between the 2 servers with set sessions for streams.

But I have never needed to do this, so there is likely a tried and tested method I don't know.

 

[Tennouji]

I'm not really knowledgeable about making php scripts, so for the meantime I just make a blank index.php on every directories to hide the contents. Kind of a little inconvenience to make one every time I add directories, but still better than leaving those folders in the open.