Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I use google spreadsheet feature that allows one to let an image be the content of a cell. The cell is defined by:

=image("http://www.example.com/my-pics/my-pic.jpg")

It works pretty well.

But, I don't want my pics to be public. So I added a .htaccess file in the my-pics directory of my web site. Here is the template I used

order deny,allow
deny from all
allow from <domain used by google-spreadsheet to get image>

My problem is that I don't know which domain I should allow? Do you have any idea?

EDIT: Just an idea, but I cannot test it on my own (I use the web server my ISP provides me and I don't have access to logs). If my .htaccess is simply

order deny,allow
deny from all

and that google spreadsheet tries to access the image, it should be logged somewhere on my web server that domain some-google-linked-domain.com has tried to access the file. Am I wrong?

share|improve this question

migrated from webapps.stackexchange.com May 12 at 7:00

This question came from our site for power users of web applications.

1 Answer 1

up vote 3 down vote accepted

I ran a quick test and got the following in my Apache access logs from adding an image to a Google Spreadsheet:

64.233.172.188 - - [09/May/2014:05:14:51 -0700] "GET twitter.png HTTP/1.1" 200 1842 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"
66.249.80.216 - - [09/May/2014:05:14:52 -0700] "GET twitter.png HTTP/1.1" 200 1842 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"
66.249.80.216 - - [09/May/2014:05:14:52 -0700] "GET twitter.png HTTP/1.1" 200 1842 "-" "Mozilla/5.0 (compatible) Feedfetcher-Google; (+http://www.google.com/feedfetcher.html)"

Interestingly, Google grabs the image three times. Aside from that, whitelisting the IP isn't going to work as Google has a lot of those (200,000+ apparently).

Based on this the best bet is to allow by the user-agent. This isn't foolproof, but should be enough for your purposes. Naturally StackExchange has the answer already - so for what you're after, start with something like:

SetEnvIfNoCase User-Agent .*Feedfetcher-Google.* search_robot

Order Deny,Allow
Deny from All
Allow from env=search_robot
share|improve this answer
    
Thanks a lot for digging into it. I'll go for that solution (provided google bots will not index my page bypassing my robots.txt). I thought that I wouldn't need to whitelist IPs, just domains. –  cjorssen May 9 at 13:05
    
You're welcome! You could filter on hostname, but doing the reverse lookup can bog your server down if it gets a bit of traffic. –  John C May 9 at 13:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.