Do not allow hot-linking of images unless logged in
<p>I just ran into something today that I am not sure how it is being done.</p>

<p>I know a few things:
The site is done in php
There is an image gallery, a url would be something like
<a href="http://www.example.com/girls/Cyn/sets/getImage/1170753147/7.jpg" rel="nofollow">http://www.example.com/girls/Cyn/sets/getImage/1170753147/7.jpg</a></p>

<p>I can see that url, as long as I am logged into the site.  It does not appear to be referrer based, as I took the url, made a new window in a browser, and was able to load it while still logged in.  In doing so, I had no referrer.</p>

<p>The second I log out, I am redirected to a please register/login page.</p>

<p>This is a heavy hit site.</p>

<p>How is this done?  I can tell they are running apache on Cent.  When I login, I am given a cookie, that has a hash of something, which I am sure they are using to lookup an id to make sure I am allowed to be logged in.</p>

<p>However, the above is a direct request for a resource that is just a jpg.  There has to be some communication then with Apache, and their database to see the state of that request.  How would merely loading a url, send off a cookie value to apache that could then pass it off to a database?</p>

<p>I am about to embark on a paid membership site, and will need to protect images in the same way.  This was not http auth, this was form based login, and I am at a loss as to how this was done.  Any ideas?</p>
