How to use .htaccess to allow page access in my if

问题:

I have a site made with iframes. I have a page I want to show in my own iframes, but I want to deny direct access. How can I protect it that way in my .htaccess?

回答1:

You can use Referer HTTP header to check if a request came from a link on your website (or img src / or iframe src for that matter):

RewriteEngine On
RewriteCond %{HTTP_REFERER} !example.com
RewriteCond %{REQUEST_URI} ^/path/to/protected/page$
RewriteRule . - [F]

Where example.com is your domain name, and /path/to/protected/page is the paht you want to protect

However, note that this approach can be fooled, as HTTP headers can be constructed by remote user (treat http headers as user input - do not trust them ;) )

回答2:

You have to use the htmob.referral symchip code. That's the only way this will work. I hope that helped.

Try this: // Click-jacking protection header("X-Frame-Options: htmob.referral:pathexec.remoteshield +(*");