AWS WAFv2 For Hotlink Protection: Future Of Content Security

AWS WAF Classic will be retired. This update describes how to utilise the latest AWS WAF (WAFv2) to avoid hotlinking. Screenshots have been updated to reflect AWS WAF Management Console changes

[{"selector":"#anim-7ca6b30d-5762-4313-8dbe-a0b1d44d506c","keyframes":[{"offset":0,"transform":"translate3d(0, -201.55887%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -56.678354244000005%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -19.269027972000004%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -7.235963433000001%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -3.144318372%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] [{"selector":"#anim-c8371db7-2a9b-4493-9e92-21886d381a30 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}]

Stop hotlinking with new AWS WAF. The AWS WAF web application firewall interfaces with Amazon CloudFront, a CDN, to protect web apps from common online vulnerabilities that affect availability, security, and resource utilisation

[{"selector":"#anim-612b46b6-05f8-463d-aa1a-a0bef3523995 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-f0844a75-f57a-4cff-bd67-deb0ca2bf2a8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}]

Hotlinking can be dealt with in a number of ways. For example, you can use the Apache module mod_rewrite to validate the Referer header at your web server

[{"selector":"#anim-b644cdff-6d97-4f1b-811d-492ec65645be","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a53d57f6-d665-4f92-a611-8ae46b2d9862","keyframes":{"transform":["translate3d(-115.09434%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-85d4f823-7a65-4546-872d-0d1ca2daa38e [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]

Validating the Referer header at the web server is less useful if you’re using a content delivery network (CDN) like CloudFront to speed up the delivery of material on your website

[{"selector":"#anim-50ca4f21-d50b-4959-b88e-ba41987e7d86","keyframes":{"transform":["scale(1)","scale(1.5)","scale(0.95)","scale(1)"],"offset":[0,0.33,0.66,1]},"delay":0,"duration":1450,"easing":"ease-in-out","fill":"both","iterations":1}] [{"selector":"#anim-2d8c4f60-816d-4be3-ac7f-0a4e10d088b9 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-12.514648210040342%, 0, 0) translate(-25%, 0%) scale(1.5)","translate3d(0%, 0, 0) translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"fill":"forwards"}]

A web access control list (web ACL) linked to a certain CloudFront distribution makes up an AWS WAF setup

[{"selector":"#anim-711bc68c-4a21-4e61-8b90-6a764f245731","keyframes":{"transform":["translate3d(-114.46541%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1000,"easing":"cubic-bezier(.2, 0, .8, 1)","fill":"both"}] [{"selector":"#anim-1c21cea4-435a-438e-b8e2-109e35ef9335","keyframes":{"transform":["rotateZ(-180deg)","rotateZ(0deg)"]},"delay":0,"duration":1000,"easing":"cubic-bezier(.2, 0, .5, 1)","fill":"forwards"}] [{"selector":"#anim-2a457641-ac72-4e1f-b36e-9d13801e2d70 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}]

The names of HTTP headers are not affected by case. The same HTTP header is referenced by referer and referer. However, the data in HTTP headers are case-sensitive

[{"selector":"#anim-bae17bb4-edf4-4b27-a8a8-bbe427213972","keyframes":{"transform":["translate3d(-114.46541%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-da49a372-321b-42a0-8220-37ff30909263","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a8e50c53-8eff-4ab9-9eb5-9b93d5eb4e6f","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-2a8778f9-1bf2-4382-95c2-174c7b96c16c [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(12.514648210040342%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}]

Traffic is permitted if the request satisfies the requirements outlined in the rule. If not, the traffic is blocked by the AWS WAF rule

[{"selector":"#anim-3b6df7d5-58e2-4f68-b1f0-6825b0b2e60c","keyframes":{"opacity":[1,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-34934b67-861a-4bcd-877d-f696b8c748a1","keyframes":{"transform":["scale(3)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-77f84a58-a244-476e-85a0-f61f9999fd67 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(0%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}]