An improved anti-leech mechanism based on session identifier

摘要

With the rapid development of information technology and extensive requirement of network resource sharing, plenty of resource hotlinking phenomenons appear on the internet. The hotlinking problem not only harms the interests of legal websites but also leads to a great affection to fair internet environment. The anti-leech technique based on session identifier is highly secure, but the transmission of session identifier in plaintext form causes some security flaws. In this paper, a proxy hotlinking technique based on session identifier is introduced firstly to illustrate these security flaws; next, this paper proposes an improved anti-leech mechanism based on session identifier, the mechanism takes the random factor as the core and detects hotlinking request using a map table that contains random factor, user's information and time stamp; at last the paper analyzes the security of mechanism in theory. The result reveals that the improved mechanism has the merits of simple realization, high security and great flexibility.