Prevent hotlinking of mp3 files?

I believe a solution based on something like this guide to blocking hotlinking with htaccess would solve your situation.

I'm not sure that the audio module can or should do anything to prevent this - it would really be more of a site specific or drupal core kind of a problem (I believe, though I'm not sure).

Audio file download links are outside drupal filesystem. It surprised me too.

I have the exact same problem. .htaccess for referrer protection does no good.
I'm in process of hacking audio module to work with lighty to have time limited downlod URLs, but no1 wants to help. Will continue to develop some more when i have the time.
http://drupal.org/node/149253

please continue your work... it would be really great to have this fixed!

I am not sure if you meant to report this as a 5.x instead of 4.7 issue, but from my own experience this isn't an issue in the 5.x versions of the audio module. Audio module creates it's own play and download links to retrieve the file from its location, and will deny access based on drupal permissions. If people are able to hotlink it is most likely because Anonymous users have drupal permission to access download URLs. Try changing drupal permissions for anonymous users for the audio module.

If you want to explicitly block direct access to the files/audio directory, just drop an .htaccess file with the line

deny from all

into the files/audio directory and the public web will not be able to link directly to the directory and will have to go through the drupal URL system to retrieve the file.

Note: If you started with public file access in drupal and then switched to private, and the files/audio directory is still publicly accessible, the URL generated by drupal will change. To ensure that they can't hotlink after switching to private file system, you need to put an htaccess file in that directory or otherwise move it outside of the www/ directory to make it inaccessible to public access, because the old URL may point directly to the file.

Ah. I believe you can still accomplish this with the .htaccess file. See this article for more info on preventing hotlinking with htaccess.

I believe you would end up with something like this (replacing mydomain.com with your website) in your htaccess file.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(mp3|wav|ogg|aiff)$ - [F]

This is just a guess, haven't actually tried it.

What you are up against is a function/feature/drawback of the HTTP protocol itself.
If you are choosing to allow anonymous access to your resources (which is fair enough) the next fallback is catching the request and filtering on the information the browser sends.
If the user is deliberately cloaking themselves, then yes, they will be denied. That is their choice. HTTP_REFERRER is all you have left to go on.

If you are looking for sorta-authentication beyond those two options, you'll have to build it yourself. It could be done by checking cookies to detect if that user had ever visited your site that session, but that too could be cloaked by someone who set their browser to paranoid.

Really advanced redirects, indexed by tokens/tickets could be constructed (as seen in some big filesharing mega-hosts) but that's quite messy, and certainly not audio.modules job. It may exist as an add-on module under file management. Something like that has probably been done under the download-purchase system of ecommerce, but that's a guess.
Unless you want to code a lot yourself, you'll have to go with the tried and tested .htaccess referrer method. It's good enough for most of the world, and the drawbacks are not really that big.

I dunno what your site is doing, but note that trying this will also neccessarily break podcast and RSS feeds for audio too. By design, as the system can't tell the diff between your feedreader and a random hotlinker.

HTTP 101. Sorry.

If http_referrer isn't reliable enough then the only solution is dman's more complex solutions which are (IMO) quite a bit more complex and as he says not really something that audio module should have to worry about.

So, I mark this fixed since we've discussed a lot of options (some of them twice) and it doesn't seem like there's much more to discuss.

I'm having this issue also, I use Lighttpd and not apache, so instead of using .htaccess I added the following to the Lighttpd config file:

$HTTP["referer"] !~ "^($|http://www\.mydomain\.com)" {
url.access-deny = ( ".mp3", ".zip" )
}

This does stop hotlinking from other sites, but it doesnt prevent my main problem, simply typing the url of an mp3 directly into the browser will still allow anyone to download it. How do you prevent that?

I've posted this here in the hope that someone somewhere knows how to do this. I've searched for days and posted both on the drupal forum, Lighttpd forum and several other related forums and nobody seems to know how to solve this issue, which to me is quite unbelievable as it should be a huge issue for thousands of webmasters.

hi,
I am having same issue. I am using jplayer to play .mp3 on my site and i want to prevent .mp3 files from being downloaded.At the time of playing .mp3 file jplayer shows full url of that file if i copy and paste that url in other browser its started to download that file.
If anyone knows the solution please help me.