Safari PDF viewer does not recognize referrer?

Question

My goal is to have user-uploaded files (mostly PDF) available for download only via a link from the host website.

I've protected user-uploaded files with an .htaccess file that resides in the uploads directory. .htaccess checks the referrer against the hard-coded domain name, and if the referrer matches, it allows access. Otherwise access is denied.

This works fine, except when following the file links in Safari for PDFs. Safari attempts to open them in-browser, and subsequently gets denied, even though the referrer was correct.

Any thoughts how to enable Safari users to view these files when coming from the correct location?

Answer 1

The Referer (sic) header is very unreliable at best. When using it, I'd only disallow users with a blatently wrong referrer, 'referrerless' requests should go through as they might be perfectly legitimate.

You claim the referrer was correct, although Safari is blocked, and that's the only check you claim to do. Logically, the referrer is NOT correct: what's in your access and/or error log of apache?

I would solve it with a session (or pseudo session), or possibly even with creating temporary (empty) files based on remote ip-address, and base access on either existance of session, or existance of ip-related temporary file.