Access php-file only through page
<p>I am serving pictures and videos through a php-file (let's call it serveMedia.php) to my index.php.
I use mod_rewrite, php-sessions and a token included in the URL to call those media files from the index.php, e.g. <code>src="media=SOMEFILENAME&amp;type=jpeg&amp;token=2134573946284615492345"</code>
The media-files themselves lie in a folder with restricted acces by .htaccess (<code>deny from all</code>)</p>

<p>Now my question: is there any possibility to make this URL only accessible through my index.php?
What I try to achieve is that users can see the content only when it is delivered through my page and not when they visit it's URL.</p>

<p>Maybe there are some advanced .htaccess or php-options I don't know?
I'm on a hosted space so these two are probably my only options.</p>

<p>This is what I'm working with at the moment:</p>

<p><strong>index.php</strong></p>

<pre><code>ob_start();

session_start();

if (!isset($_SESSION['token']) || $_COOKIE['PHPSESSID'] !== session_id()){
    $token = md5(uniqid(rand(), true));
    $_SESSION['token'] = $token;
}
else {
    $token = $_SESSION['token'];
};
</code></pre>

<p><strong>serveMedia.php:</strong></p>

<pre><code>if(isset($_GET['token']) 
    &amp;&amp; $_GET['token'] == $_SESSION['token'] 
    &amp;&amp; $_COOKIE['PHPSESSID'] == session_id()){

        //streamthisfile!

else {
    header($_SERVER['SERVER_PROTOCOL'].' 404 Not Found', true, 404);
    echo "no file";
    session_regenerate_id(true);
    session_destroy();
    unset($_SESSION);
}
</code></pre>

<p>Appreciate your help!</p>
