prevent from linking css from others sites

I have a comerce css on my site. I use IIS and vendor says that others can use my css fonts because开发者_StackOverflow社区 they know the url. Is it possible to set server or something so that only my site can use it ? It is about cufon

Things you can do:

1. Give up. If your users can see it, they can steal it. Similarly, don't expect to protect your site from users viewing its source code.
2. If the font is a vector font, rasterize the font for all the font sizes you support, but no others. This may have a negative impact on browsing experience of your users. This makes stealing your font give less useful data, but doesn't actually stop the theft.
3. Replace all use of the font with bitmaps. Much more work to steal in that case, and only gives the user rasterized version of font (and not necessarily all the letters). You can create a special text UserControl that sticks a bitmap where-ever you put it, so this isn't actually that much work to do or maintain. It does increase the bandwidth requirements for your page, though. It also forces you to do some of the layout by hand that is normally handled by the browser, which could add heavy maintenance costs or minimal maintenance costs, depending on how your site's layout works. And as with #2, it can have a negative impact on browsing experience of your users. It also hurts accessibility, though not absurdly so since your UserControl will presumably use alt text to duplicate the text.

I strongly recommend #1.

If you are on IIS7 or greater you can perform a Referer check without writing any custom code, simply by using IIS URL Rewrite in the manor discussed here. However as simply a Referer check, it has the shortcomings discussed in the other answers given.

(For introduction to IIS URL Rewrite see here.)

Excerpt from the first link:

Let me now explain what we have done on this property page:

• Specified name of the rule as "Prevent Leeching". This must be a unique rule.
• Every requested URL will be matched as the pattern is ".*" and is a regular expression.
• Added two condition and specified both the condition to be satisfied (see "Logical Grouping" is "Match All")
• HTTP_REFERER does not match empty as it can be a direct reference to the image
• HTTP_REFERER does not match my own site http://www.contoso.com

If the above two conditions are satisfied (apparently meaning the request is coming from any other site), we are just redirecting it to pick up some other image which can be anything And that's it. So without writing even a single line of code we are able to prevent hot-linking.

I would probably tailor your Rewrite configuration so that it is only performed on your font URLs (and other static assets of concern) rather than every single incoming request.

If you don't have remote desktop access or are just editing web.config, your rewrite rule will probably look something like:

    <rule name="block font leaching" stopProcessing="true">
      <match url="myFontFile.woff" />
      <conditions logicalGrouping="MatchAny">
        <add input="{HTTP_REFERER}" pattern="^$" /><!-- no referrer -->
        <add input="{HTTP_REFERER}" pattern="yourdomain.com" negate="true" /><!-- or not your site -->
      </conditions>
      <action type="AbortRequest" /><!-- block the request -->
    </rule>

In this example I choose the block the request entirely (through AbortRequest), however you could just as well have redirected to a page with a friendly notice.

Not reliably. In order to serve up the embedded fonts they need to readable by the public, and referable by your CSS.

What you could do is create an asp.net page, or a handler which takes a parameter of the font file, reads the file from somewhere in your web site (APP_DATA is a good place to put them - you can't browse to APP_DATA) and spits it out. In the script you could check the HTTP_REFERER server side variable and if it is either blank, or comes from your site you server the file, if it doesn't you don't.

MSDN has an example of how to serve up a binary file in C#. You'll need to ensure you get the MIME type right, however be aware this would probably break any caching provided by the browser or proxies. This also wouldn't stop people downloading the fonts by typing the URL into their browser and saving them locally, but if bandwidth is the concern that's not really going to be a problem.

If you're on IIS7 you could write an Http Module which would do the referrer check for you, Scott Hansleman wrote one for image leeching prevention quite a while ago, you could edit that to match your purposes.

You could make an http handler to serve up css files. In your custom http handler, check that the request.Url.Host equals request.UrlReferrer.Host. If they don't match, set the response to 404 or serve up an empty css file.

This is untested but should be close to what you would need. You would add a link to css like:

<link rel="Stylesheet" href="CustomCSSHandler.ashx?file=site.css" />


public class CustomCSSHandler : IHttpHandler 
{
    public void ProcessRequest(HttpContext ctx) 
    {
        HttpRequest req = ctx.Request;
        //Get the file from the query stirng
        string file = req.QueryString["file"];
        //Find the actual path
        string path = ctx.Server.MapPath(file); //Might need to modify location of css

        //Limit to only css files
        if(Path.GetExtension(path) != ".css")
            ctx.Response.End();

        if (req.UrlReferrer != null && req.UrlReferrer.Host.Length > 0)
        {
            if (CultureInfo.InvariantCulture.CompareInfo.Compare(req.Url.Host, req.UrlReferrer.Host, CompareOptions.IgnoreCase) != 0)
            {
                path = ctx.Server.MapPath("~/thiswontexist.css");
            }
        }   

        //Make sure file exists
        if(!File.Exists(path))
        {
            ctx.Response.Status = "File not found";
            ctx.Response.StatusCode = 404;
            ctx.Response.End(); 
        }           

        ctx.Response.StatusCode = 200;
        ctx.Response.ContentType = "text/css";
        ctx.Response.WriteFile(path);
    }
}