Lighttpd

you're right, it's a limited design, a expected result.

Is there any chance that this will change?

My situation is as follows: We want to protect against hotlinking - but only from that subdirectory (images). We offer other image material, like Banners etc. from other directories where we encourage people to hotlink.
I can currently think of working around this by moving them to different domains, so it's not critical - but it would be nice.

Also you mention it is expected - are there any hints (without reading code) to find out which conditional-nesting can work and which one would not. Thanks. :)

-- alisencer (et) gmail com

I think this should work:

$HTTPreferer !~ "^($|http://www\.fussball-forum\.de)" {
$HTTPurl =~ "^/images/" {
url.access-deny = ( ".jpg", ".jpeg", ".png", ".gif" )
}
}

-- Nicolae Namolovan

Oops, bad formating.

Just put $HTTPurl inside $HTTPreferer
$HTTPurl must be allways the last, at least in 1.4.x

$HTTP["referer"] !~ "^($|http://www\.fussball-forum\.de)" {
  $HTTP["url"] =~ "^/images/" {
     url.access-deny = ( ".jpg", ".jpeg", ".png", ".gif" )
  }
}

-- Nicolae Namolovan

fixed in r1942

Why this doesn't deny access to http://jsdev.ru/book/javascript-bible.zip with NO referer ?

$HTTPurl =~ "^/book/(.*)\.zip$" {

        $HTTPreferer !~ "jsdev\.ru$" {

                url.access-deny = ( "" )

        }

}

Seems bug still open ?

-- iliakan

See #1164 for patch.