Tim Yang’s Weblog

Chris Josephes writes in Oreillynet about an interesting method for finding out if an image that one of your visitors is hotlinking is instead sending a substituted image. Hotlinking is often a danger in forums and blog comments where there is no preset control over what is posted.

Chris says:

If any site user makes a posting that inlines images from a third party server, the editing software should retrieve the image twice using the HTTP HEAD method. For the first retrieval, don’t pass a Referer header. For the second retrieval, set a Referer header that would reference the full URL of the page that would eventually load the image. For both requests, the HTTP server headers Content-Length and ETag should return identical values. If they don’t, that means the web server is sending out different files. Make sure the comment poster is aware of this, and give them the opportunity to correct the problem.

This would be really nice if someone used this method in a plugin for blog CMSes.