I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header referral is empty and unable to match the WAF trusted domain policy. Anyone can suggest what is better to way to protect the Mobile content since the WAF not working for mobile requests.

  • Do you control the site or are you wanting to control the clients under your control?
    – schroeder
    Aug 30, 2019 at 10:45
  • Is it an app you want to filter or web requests?
    – schroeder
    Aug 30, 2019 at 10:48
  • I want to control the site assets usage. This should be presentable only through the proper authenticated channel.
    – Aadi
    Aug 30, 2019 at 11:30
  • 2
    Whether you realize it or not, you're effectively trying to implement a DRM, which is not at all fool proof. The best you can do is make it harder for people to access your things. Aug 30, 2019 at 12:16
  • 1
    In particularly, you should know that you haven't restricted access from the web. If all you are doing is using a WAF that requires a Referrer header, that is extremely easy for an attacker to spoof. Aug 30, 2019 at 12:17

1 Answer 1


What you want to do is called the DRM Problem, and it can't be solved. No matter what measures you take, I can always circumvent them.

  • If you create an image and want to display it on my screen, I can copy it.
  • If you create an audio track and want it to play on my speakers, I can copy it.
  • If you create a piece of JavaScript code and want it to run in my browser, I can copy it.

As soon as I have access to it, I can copy it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .