Wondering what to do (if anything) about hotlinking

Wondering what to do (if anything) about hotlinking
kryogenix.org

Things like HTTP Referrer, coupled with a set of rolling dynamic headers so actual site visitors aren't impacted, or significant rate limiting, or a simple non-malicious HTTP widget injection that sends a simple message, stop the unauthorized hotlinking.

You could even take it a step further by evaluating at the packet header level but that's a bit of a setup.

The same origin policy restricts any load that would provide JS with data from a different origin. Note that I did not say it blocks all loads: this is specifically restricting JS access to content from other services. CORS was introduced so that it was possible to selectively provide JS with access to such data - previously you had to use JSONP which has bad security properties for the client and server. CORS is what lets JS on your site make an XHR to a remote API provider. Nothing stops you from simply creating an arbitrary element with an arbitrary src attribute (if relevant of course), and triggering a network load. It’s just that most such elements don’t convert the server response into data that can be subsequently accessed in JS, the ones that do (img, etc) can only be read via APIs that themselves enforce same origin restrictions (eg I can create an image element and point it to a remote server, then draw that image into a canvas. At that point the canvas element’s various read APIs will stop working as the canvas knows that it’s been tainted).

If you were to make non-same origin loads fail in the general case you would break everything.

I've had people do this to me and then I go to update my stylesheet on my website and suddenly a ton of other websites I use are broken and I was like "wtf". After trying to get people to stop directly embedding it and realizing the problem was just too widespread, I ended up having to freeze an old copy of my stylesheet at the fixed URL that everyone was using and now I generate random URLs for my new stylesheet updates (that both look like something you shouldn't rely on and which do disappear later).

(FWIW, I will say that the random URLs are probably a better solution anyway as if you are going to have a stylesheet used by various pages of yours it is difficult to do an atomic upgrade of the resource and the pages that use it without momentarily breaking some content. My "random" URLs are actually hashes and it is honestly better than what I had before.)

The replacement solution worked for 3D Realms many years ago after a bunch of journalists, fansites, and forums would link to their game screenshots. When someone did, their image would be replaced with Duke Nukem dressed up as Uncle Sam, pointing at the screen, and captioned with something like "Duke wants you to host your own images"