Denying web viewers access to a folder but still allowing the server access?

[ukballer1012]

I just started learning apache yesterday and I couldn't find this on the internet anywhere so bear with me. I have a folder called "images" which contains all the images my site uses. I would like to deny web viewers access to the specific folder (to where they can't access the url but can still see elements on my webpages that use those images). I want to set it up using a directory directive but I don't know how. This is how I have it set up currently:


<Directory "/var/www/html/images">
Order allow,deny
Deny from all
Allow from localhost
</Directory>

Pointing me to a guide that also shows a solution would be appreciated.

[Luuk]

I think that's not possible with some config option in apache.

However, you could create a i.e. PHP-script which is able to read outside the webroot, and make it return the image.

something like (untested):

<?php
$name=$_GET["name"];
header('Content-type: image/jpeg');
echo file_get_contents($name);
}
?>

When you call this like:

http://www.example.com/image.php?name=/images/1.jpg

it should show the image which is stored in /images/1.jpg
(if PHP has enough access to read it.)

But, be aware that this will always read every file, not just jpg-files, you should add the needed checks,
Because:

http://www.example.com/image.php?name=/etc/passwd

will return your password file ;)