4

Particular parts of a website I'm working on will have pictures not intended for the general public. It is already behind a password protection and the page has no-index no-follow rules. I'm concerned about images though.

One site said to enable

robots.txt

User-Agent: *
Disallow: /private-images

Then if someone goes to http://www.companywebsite.com/robots.txt they would very easily be able to see where we're storing said private-images. However, they should get a 403 Forbidden error if they try to access that directory. However, I want to be as sure as possible that this is the best way.

Is there any other things to consider and implement to protect unwanted eyes from accessing images on a website? Trying to protect trade secrets so only registered dealers can see the information.

  • 2
    Using robots.txt, noindex and nofollow only stops Google, Bing and so on indexing it. It doesn't not prevent those files being accessed. You need to use proper authentication if you want to secure your site. – Simon Hayter Oct 8 '15 at 21:13
  • @SimonHayter --- I already said the area of the site is behind password protection. Is that what you mean or what can be done specifically for the images? – Ryan Oct 9 '15 at 10:29
  • 1
    If an unauthenticated user tries to access one of the private image URLs directly, are they prompted for authentication? If yes, then you have nothing to worry about. If no, then that's what you need to fix. – Tim Fountain Oct 9 '15 at 11:18
  • @TimFountain like companyname.com/private-images/secret.jpg can be passworded? How would I go about doing that? – Ryan Oct 9 '15 at 11:20
1

Trying to protect trade secrets...

Displaying those "trade secrets" is just wrong. By advertising parts of files in robots.txt that you don't want people to try to access is an extra opportunity for hackers to try to gain access to your system.

As Simon noted, you need to use authentication. This normally means requiring a valid username and password from authorized guests to access the secret elements.

If that's too much for your guests, then a captcha may work, but I don't recommend it because hackers could catch on to it.

If the items are true trade secrets, you could get hefty with security and require users to check their email for a unique code when they login successfully as an extra step to prove they are real.

As for the unauthorized users, returning an error 403 is fine for the moment. As for the authorized guests and for maximum security, you should make a special URL that takes users to a login page where they can validate themselves.

What most sites do which is somewhat less secure is redirect users to the login page instead of giving error 403 when they try to access restricted content. I say this is somewhat less secure because robots can also be redirected to the login page which then gives them an opportunity to hack the system. By giving the special login URL to only a handful of people, you're lowering the chances of a robot attacking the server.

  • ...I stated in my question, "it is already behind a password protection" so not really sure why the bulk of your answer is about password protection. And said login is unlisted and unlinked. Only way they get to it is by calling us. Mostly concerned that the images could still end up on some Google / Bing Image Search. – Ryan Oct 9 '15 at 10:28
1

As you already know, authentication is the way to solve this problem. It is not clear to me, if you currently only protect the pages showing the images, or if you protect the images themself. Protecting the images can be done in several ways:

  1. It is possible to put the images into a separate directory and use basic access authentication to protect the whole directory (.htaccess). Your application could set the necessary headers, while requests with only the URL won't get the images. Note that this is only secure together with SSL connections.

  2. Instead of using URL's to the real location of the images, you could work with URL's interpreted by your application. When your application e.g. gets a request like http://www.example.com/img/12abdi341ldkfjoi, it could fetch an image from a directory which is not visible to the web /root/hidden/image1.jpg, and then load and return this image as the result of the request. Of course you can handle the authentication the same way as you do with your html pages.

What i would not rely on is, to hope that URLs to the images are not leaked, because only protected pages contain those URLs. The loaded pages will be accessible in the cache of every user and users may copy paste URLs to your images.

  • So instead of saying <img src="actualpage.jpg"> I would use some <img src="12abdi3411ldkfjoi">? Do you know what this is called so I could look up how to do it? Or have a tutorial you know of for this? – Ryan Oct 12 '15 at 12:44
  • @Ryan - You can choose the URL freely, in your case it could look like this: <img src="image.php?id=12abdi341ldkfjoi">. Then you can implement a php page called "image.php" and this page gets the id as parameter and returns the image as response. The example above in the answer is appropriate, if your application can handle "beautified" URLs, but this is not necessary. The keywords you are looking for are `http response Content-Type'. – martinstoeckli Oct 12 '15 at 13:02
0

If your password protection system works correctly (i.e., if it is secure), so users can’t access the images (even if they enter the images’ URLs directly), search engine bots won’t abe able to access the images either. Bots don’t have special powers, they are regular users in that regard.

If you want to ask bots not to try to crawl URLs of the restricted areas, you can use robots.txt. If you don’t want to disclose the actual URL, you can specify only its beginning, e.g.:

User-Agent: *
Disallow: /priv

(This would disallow crawling of all URLs whose paths starts with /priv, e.g., /private, /private/, /priv.html, /private-images, etc.).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.