4

I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that no one else could put videos on their sites or access them programmatically.

To be more clear, I am trying to figure out how to make sure that my videos are used only on the sites of my clients, and not on any unauthorized sites. Say, myclient.com wants to have a video on their site for all their visitors. How would I accomplish this?

This is my understanding so far:

  1. when the client's site is visited, and the page containing the video is requested, the client's server authenticates against my API that serves videos (is a full-scale oauth2 provider adequate here?)

  2. after that, the client's server obtains a one-time token for the specific video, which in addition to being one time, has a very short TTL

  3. the client-server renders this token as part of the page (or a javascript).

  4. then the javascript will use the token to start the video after which the token becomes expired.

Note that the part of the API that starts streaming videos is not protected by the oauth2 mechanism, and only is protected by these one-time tokens.

Would this approach work, or are there better ways to do this?


To simplify my question, I am not asking how to prevent the end user from saving the video on the local machine. I am asking whether it is feasible to prevent a website that is not authorized from embedding the videos on their pages and to make sure that only the sites that are allowed to do so, can do it.

  • Unclear what help you need. Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it’s hard to tell what problem you are trying to solve or what aspect of your approach needs to be corrected or explained. See the How to Ask page for help clarifying this question. – gnat Aug 6 '14 at 14:11
  • 1
    The moment you serve the video, people can record it (you're providing them the data feed). There's ways to make this more difficult (isn't there some media encryption proposed for HTML5?), but there's too many ways to "recover" the data on a PC. You're trying to create your own DRM library/scheme/deployment, whereas the big name entertainment companies have spent millions (or billions) of dollars and failed in the long term (and generally just annoyed legitimate users). There's likely a library for baseline protection, but you can't stop determined people. – Clockwork-Muse Aug 8 '14 at 11:05
  • I have updated my question again. – akonsu Aug 8 '14 at 19:21
  • 3
    Search for 'prevent hotlinking'. You can't 100% prevent it, but you can make it difficult. – GrandmasterB Aug 8 '14 at 19:45
  • @GrandmasterB usually it is done by checking referer header no ? – Xavier Combelle Aug 12 '14 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.