HttpModule to block external referrers in ASP.NET

I was ones faced with the issue of enforcing copyright on different files on a website. That meant that images and dynamically created XML files had to be blocked if accessed from outside the website. So, I had to find a way to prevent other websites from linking to or referencing these files. Copyright or not, it is a good idea to do it on dynamically created files such as charts, because they take a lot of computer power to generate.

That resulted in an HttpModule that stops all requests coming from outside the website to a custom list of files. If your images are inserted into a <img> tag on another domain, they will be blocked. The list can use wildcards so you can stop all files of a certain type as well. It could look like this *.gif|*.jpg|image.ashx.

Below are the two methods of the module that stops the illegal requests.

private void context_BeginRequest(object sender, EventArgs e)
{
 HttpContext context = ((HttpApplication)sender).Context;
 // Do nothing if the request is legal
 if (ReguestIsLegal(context))
  return;

 // Accessed directly
 if (context.Request.UrlReferrer == null)
 {
  context.Response.Write("Access denied");
  context.Response.End();
 }

 // Linked to or embedded into another domain
 if (context.Request.UrlReferrer.Host != context.Request.Url.Host)
 {
  context.Response.Write("Access denied");
  context.Response.End();
 }
}

privatebool ReguestIsLegal(HttpContext context)
{
 string mappings = ConfigurationManager.AppSettings["BlockMapping"];
 string fileName = context.Request.PhysicalPath;

 foreach (string map in mappings.Split('|'))
 {
  string cleaned = map.Replace("*", ".*").Replace(".", "\\.");
  if (Regex.IsMatch(fileName, cleaned, RegexOptions.IgnoreCase))
   returnfalse;
 }

returntrue;
}

The method RequestIsLegal uses regular expressions to determine if the requested file matches the mappings in the web.config.

Implementation

Download the ExternalAccessModule.cs below and add put it in the App_Code folder. Then add the following lines to the web.config’s <system.web> section.

<httpModules>
 <add type="ExternalAccessModule" name="ExternalAccessModule"/>
</httpModules>

And last, add the mappings to the AppSettings of the web.config. Modify it to match your own files.

<add key="BlockMapping" value="*.gif|*.jpg|image.ashx"/>

Download

ExternalAccessModule.zip (,85 KB)