On my website I store user pictures in a simple manner such as: \"image/user_1.jpg\".
I don\'t want visitors to be able to view images on my server just by trying us
Any method you choose to determine the source of a request is only as reliable as the HTTP_REFERER information that is sent by the user's browser, which is not very. Requiring authentication is the only good way to protect content.