Access to private file only from website, not using direct link

Question

My private files has a visible URL like the following: https://mywebsite.com/system/files/myimage.jpg.

How can I restrict access to the file, so it cannot be viewed directly from this URL but only from link on my website?

I have tried to use SESSION as follows.

$_SESSION['file-access'] = TRUE;
$output = theme('image_style', array('style_name' => 'foto_preview', 'path' => $uri));

Then I controlled in hook_file_download() if the SESSION key 'file-access' exists, but the session key never exists. The image I wish to display is the value of an image field. I cannot use $user because I wish to display private files also for anonymous users.

Can anybody help on how to restrict the direct access to a private file, but allow access from website?

EDIT 30.7.2013: my mistake, using sessios works OK, I had a mistake in another unrelated part of code. The problem is solved.

Answer 1

You need to use private filesystem as shown in documentation. Then you can create custom module to implement more advanced rules, like link timeouts et cetera.

Answer 2

You can do this similar with hot linking htaccess protection.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.tld/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.tld/image_or_page_to_show_instead [R,L]

Just put your condition instead \.(gif|jpg)$