<IfModule mod_rewrite.c>
    RewriteEngine On
    # 定義允許的白名單域名（正則匹配，支持子域名）
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?partner-site\.com [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?cdn\.yourdomain\.com [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?localhost [NC]
    # 對(duì)圖片資源應(yīng)用防盜鏈
    RewriteRule \.(jpg|jpeg|png|gif|webp|bmp|svg|ico)$ - [F,L]
</IfModule>

<?php
// 密鑰必須與服務(wù)端一致
$secret = 'YourStrongSecretKey_2024!';
$expire = time() + 300; // 5分鐘有效期
function generateImageToken($path, $expire, $secret) {
    $data = $path . '|' . $expire;
    return hash_hmac('sha256', $data, $secret);
}
$imagePath = '/uploads/2024/photo.jpg';
$token = generateImageToken($imagePath, $expire, $secret);
$url = "https://img.yourdomain.com{$imagePath}?t={$token}&e={$expire}";
// 輸出: https://img.yourdomain.com/uploads/2024/photo.jpg?t=abc123&e=1715000000
?>

<IfModule mod_rewrite.c>
    RewriteEngine On
    # 僅對(duì)圖片目錄啟用
    <Directory "/var/www/images">
        # 提取 URL 參數(shù)
        RewriteCond %{QUERY_STRING} ^(?:.*&)?t=([^&]+)(?:&.*)?$ [NC]
        RewriteRule .* - [E=TOKEN:%1]
        RewriteCond %{QUERY_STRING} ^(?:.*&)?e=([^&]+)(?:&.*)?$ [NC]
        RewriteRule .* - [E=EXPIRE:%1]
        # 構(gòu)建驗(yàn)證字符串：路徑|過(guò)期時(shí)間
        RewriteRule .* - [E=VERIFY_STRING:%{REQUEST_URI}|%{ENV:EXPIRE}]
        # 計(jì)算期望的 HMAC（需要 mod_setenvif 或外部程序，這里用 Lua/外部腳本）
        # 方案A：使用 mod_lua（推薦，高性能）
        <IfModule mod_lua.c>
            LuaHookAccessChecker /etc/apache2/scripts/verify_token.lua verify_token
        </IfModule>
        # 方案B：使用外部程序驗(yàn)證（性能較低，適合低頻）
        # RewriteMap token_verify prg:/etc/apache2/scripts/verify_token.py
        # RewriteCond ${token_verify:%{ENV:VERIFY_STRING}|%{ENV:TOKEN}} !^VALID$
        # RewriteRule .* - [F,L]
        # 檢查過(guò)期時(shí)間
        RewriteCond %{TIME} > %{ENV:EXPIRE}
        RewriteRule .* - [F,L]
    </Directory>
</IfModule>

-- 需要安裝 libapache2-mod-lua
require "apache2"
require "hash"
require "string"
local secret = "YourStrongSecretKey_2024!"
function verify_token(r)
    local token = r.subprocess_env["TOKEN"]
    local expire = r.subprocess_env["EXPIRE"]
    local path = r.uri
    if not token or not expire then
        return apache2.DECLINED -- 讓 Rewrite 規(guī)則處理（返回403）
    end
    -- 檢查是否過(guò)期
    local now = os.time()
    if tonumber(expire) < now then
        return apache2.HTTP_FORBIDDEN
    end
    -- 計(jì)算 HMAC
    local data = path .. "|" .. expire
    local expected = hash.hmac_sha256(data, secret)
    -- 安全比較（防時(shí)序攻擊）
    if not secure_compare(token, expected) then
        return apache2.HTTP_FORBIDDEN
    end
    return apache2.OK
end
function secure_compare(a, b)
    if #a ~= #b then return false end
    local result = 0
    for i = 1, #a do
        result = result | (string.byte(a, i) ~ string.byte(b, i))
    end
    return result == 0
end

<IfModule mod_headers.c>
    # 對(duì)圖片強(qiáng)制 inline 顯示，但阻止"另存為"對(duì)話框的默認(rèn)行為
    <FilesMatch "\.(jpg|jpeg|png|gif|webp)$">
        Header set Content-Disposition "inline"
        # 禁止瀏覽器緩存圖片到本地（減少離線查看）
        Header set Cache-Control "private, no-store, max-age=0"
    </FilesMatch>
</IfModule>

# 使用 mod_pagespeed 自動(dòng)添加水印（需安裝）
<IfModule pagespeed_module>
    ModPagespeedEnableFilters rewrite_images
    ModPagespeedEnableFilters insert_image_dimensions
    # 自定義水印濾鏡
    ModPagespeedImageMaxBytes 2097152
</IfModule>

# 使用 mod_evasive 限制單 IP 圖片請(qǐng)求頻率
<IfModule mod_evasive24.c>
    DOSHashTableSize    3097
    DOSPageCount        5          # 同一頁(yè)面5秒內(nèi)超過(guò)5次
    DOSSiteCount        50         # 同一站點(diǎn)5秒內(nèi)超過(guò)50次
    DOSPageInterval     5
    DOSSiteInterval     5
    DOSBlockingPeriod   600        # 封禁10分鐘
    DOSEmailNotify      admin@yourdomain.com
    DOSLogDir           "/var/log/mod_evasive"
</IfModule>

<IfModule security2_module>
    # 攔截?zé)o Referer 的批量請(qǐng)求（爬蟲(chóng)特征）
    SecRule REQUEST_FILENAME "@rx \.(jpg|jpeg|png|gif|webp)$" \
        "id:1001,phase:1,block,log,msg:'Image access without referer',\
        chain"
        SecRule REQUEST_HEADERS:Referer "@streq" \
            "setvar:ip.image_requests=+1,expirevar:ip.image_requests=60"
    # 單 IP 60秒內(nèi)超過(guò)100次圖片請(qǐng)求則封禁
    SecRule IP:IMAGE_REQUESTS "@gt 100" \
        "id:1002,phase:1,deny,status:403,msg:'Rate limit exceeded for images'"
    # 攔截常見(jiàn)爬蟲(chóng) User-Agent
    SecRule REQUEST_HEADERS:User-Agent "@pm wget curl python scrapy" \
        "id:1003,phase:1,deny,status:403,msg:'Bot detected'"
</IfModule>

<!-- 前端示例：圖片通過(guò) Canvas 繪制，DOM 中不暴露真實(shí) img 標(biāo)簽 -->
<canvas id="protected-img" width="800" height="600"></canvas>
<script>
fetch('/api/get-image-token?path=/uploads/photo.jpg')
    .then(r => r.json())
    .then(data => {
        const img = new Image();
        img.crossOrigin = 'anonymous';
        img.onload = function() {
            const canvas = document.getElementById('protected-img');
            const ctx = canvas.getContext('2d');
            ctx.drawImage(img, 0, 0);
            // 添加視覺(jué)水印
            ctx.font = '14px Arial';
            ctx.fillStyle = 'rgba(255,255,255,0.5)';
            ctx.fillText('? YourDomain ' + new Date().getFullYear(), 10, 30);
        };
        img.src = data.url; // 帶 Token 的 URL
    });
</script>

# 使用 mod_rewrite + mod_proxy 將縮略圖請(qǐng)求代理到處理服務(wù)
RewriteRule ^/thumb/(\d+)x(\d+)/(.*)$ \
    http://localhost:8080/thumbnail?w=$1&h=$2&path=$3 [P,L]

# ==================== 全局設(shè)置 ====================
ServerTokens Prod
ServerSignature Off
# ==================== 模塊加載 ====================
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule headers_module modules/mod_headers.so
LoadModule lua_module modules/mod_lua.so
# ==================== 圖片目錄防護(hù) ====================
<Directory "/var/www/images">
    Options -Indexes -FollowSymLinks
    AllowOverride None
    Require all granted
    RewriteEngine On
    # ---- Layer 1: Referer 白名單 ----
    RewriteCond %{HTTP_REFERER} !^$
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?cdn\.yourdomain\.com [NC]
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?localhost [NC]
    RewriteRule \.(jpg|jpeg|png|gif|webp|bmp|svg)$ - [F,L]
    # ---- Layer 2: Token 驗(yàn)證 ----
    RewriteCond %{QUERY_STRING} ^(?:.*&)?t=([^&]+)(?:&.*)?$ [NC]
    RewriteRule .* - [E=TOKEN:%1]
    RewriteCond %{QUERY_STRING} ^(?:.*&)?e=([^&]+)(?:&.*)?$ [NC]
    RewriteRule .* - [E=EXPIRE:%1]
    # 過(guò)期檢查
    RewriteCond %{TIME} > %{ENV:EXPIRE}
    RewriteRule .* - [F,L]
    # Lua HMAC 驗(yàn)證
    <IfModule mod_lua.c>
        LuaHookAccessChecker /etc/apache2/scripts/verify_token.lua verify_token
    </IfModule>
    # ---- Layer 3: 響應(yīng)頭加固 ----
    <IfModule mod_headers.c>
        Header set Content-Disposition "inline"
        Header set Cache-Control "private, max-age=300"
        Header set X-Content-Type-Options "nosniff"
        # 禁止圖片被嵌入 iframe（點(diǎn)擊劫持防護(hù)）
        Header set X-Frame-Options "DENY"
        # CSP 限制圖片加載來(lái)源
        Header set Content-Security-Policy "img-src 'self' data:; default-src 'none'"
    </IfModule>
    # ---- Layer 4: 頻率限制（需 mod_evasive）----
    <IfModule mod_evasive24.c>
        DOSPageCount        10
        DOSSiteCount        100
        DOSBlockingPeriod   300
    </IfModule>
</Directory>
# ==================== 日志記錄 ====================
CustomLog "/var/log/apache2/image_access.log" "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{UNIQUE_ID}e"