Protecting mp3 files from direct download

[Mikkel Fausing]

Hi, I'm trying to implement the jPlayer on a site that previews sound and video (only gotten to sound so far).

Anyhow, I'd like to prevent visitors from downloading the mp3 files, so I've put up a .htaccess that only allows people coming from an approved domain like so:

RewriteEngine on

RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?lani.dk [NC]

RewriteRule \.(jpg|jpeg|png|gif|mp3)$ http://www.cinemation.dk/site/images/replace.jpg [NC,R,L]

the files are located on http://www.cinemation.dk/protected/somethingsomething.mp3

with the .htaccess residing in /protected.

However, I seem to be getting issues with playing files (especially with firefox and IE).

It is unfortunately a dealbreaker if I can't protect the files, as the artists sometimes want to keep the file private.

Does anyone know if there is a work-around to this? Or if I'm doing something wrong elsewhere? I don't care if I have to upload in multiple/other formats, as long as neither are downloadable.

The problem exists here: http://lani.dk/cinemation/cinesound.asp

while a working clone of the page, (utilizing an unprotected source instead) can be found here: http://lani.dk/cinemation/cinesound_surftown.asp

regards,

Mikkel

[David Deen]

What I do is write a session object, I then have a httphandler that checks for it before it allows the file to be accessed, it then also removes the session object.

It is by no means perfect and secure but it enough to prevent 99% of people which is enough for us certianly.

heres what we do

1) user clicks play link on a page
2) page calls a webservice which creates the sessionobject (enable session objects on the webservice must be set to allowed)
3) on the webservice call back the code then passes the link to the file to jplayer
3) the link is in fact a file handler, this handles the request
4) the session is cleared and file is delivered