Ignoring the merits of whether we should make this change or not (the circumstances are slightly complex and probably covered by my NDA), our client would like us to require that visitors to the site we're building have come from another of their sites. If a user comes to us from elsewhere, they should be sent to the login screen of that other site.

It feels like the easiest way to do this is using `mod_rewrite` to redirect anything with a referrer that is neither our site nor this other one.

My current thinking is

In `httpd.conf`

```
RewriteMap deflector txt:/path/to/deflector.map
RewriteCond %{HTTP_REFERER} !=""
RewriteCond ${deflector:%{HTTP_REFERER}|NOT-FOUND} =NOT-FOUND
RewriteRule ^ http://www.theothersite.com/login.jsp [R=307,L]

```

In `deflector.map`

```
//www.oursite.com/ -
//oursite.com/ -
//www.theothersite.com/ -
//theothersite.com/ -

```

This would allow us to expand the list of "permissible referrers" quite easily, which feels like a good idea.

I have three questions then:

1. Is `mod_rewrite` (which we're already using extensively) the best way of doing this?
2. If it is, then is a `307 Temporary Redirect` response the best way to handle it?
3. As I'm not primarily a LAMP dev / admin, have I made any stupid typos in those rewrite rules? ;o)

It feels to me that `307 Temporary Redirect` or `403 Forbidden` are the most appropriate [status codes](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html) and I assume it's A Bad Thing™ to send a `Location:` redirect header with a `4xx` response.

That all make sense?

**Edit:** Are the map searches case-*in*sensitive by default? Do I need to worry about case here?  

**Edit 2:** Are map searches a regex search or a whole-key match? If the map contains `www.foo.com` and the `Referer:` header reads `http://www.foo.com/bar.php` will it match?