Monday, April 21, 2008

ISAPI Rewrite for File Protection

For as long as I have been building and marketing websites, I have been a Linux/Apache/mySQL/PHP (LAMP) guy. NetIQ web pages were created using ASP on IIS.

One refreshing IIS/Apache similarity I have found is Helicon's ISAPI Rewrite IIS module. It is an implementation of many of Apache's mod_rewrite features for IIS. It uses a config file with near-identical Apache syntax. NetIQ has been using this product for some time now and I was happy to see it.

One novel use for the ISAPI Rewrite filter is its ability to protect files, like trials, from being downloaded without first completing a registration. While creating new PPC landing pages, I realized I need to make a large .exe available for download, but only to people who complete a specific form. While there are probably better ways to do this using ASP, I was going for simplicity and minimal infrastructure modification. So here is my ISAPI/Apache code:

RewriteCond Referer: ^(?!http://example\.com/PPC/the_referrer\.asp)(.+)$
RewriteRule /PPC/downloads/the_download.asp /PPC/no\.asp [I,RP,L]


The first line states that the rule only applies if the visitor's referrer isn't http://example.com/PPC/the_referrer.asp. Then the rule itself redirects from the "protected" page (or .exe) to a page that explains the file cannot be accessed directly.

Obviously, this method of protection can be circumvented by simply faking the headers sent to the webserver, but the person would still need to know the url of the .exe. In this case, the .exe is a software trial that is otherwise available on our website, so nothing is lost if someone decides they want to get around my protection measures. What it does effectively do is prevent someone from linking to the .exe from their website or emailing the .exe url to someone. I want to capture as many leads from downloads as is practical.

No comments: