I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that no one else could put videos on their sites or access them programmatically.

To be more clear, I am trying to figure out how to make sure that my videos are used only on the sites of my clients, and not on any unauthorized sites. Say, myclient.com wants to have a video on their site for all their visitors. How would I accomplish this?

This is my understanding so far:

  1. when the client's site is visited, and the page containing the video is requested, the client's server authenticates against my API that serves videos (is a full-scale oauth2 provider adequate here?)

  2. after that, the client's server obtains a one-time token for the specific video, which in addition to being one time, has a very short TTL

  3. the client-server renders this token as part of the page (or a javascript).

  4. then the javascript will use the token to start the video after which the token becomes expired.

Note that the part of the API that starts streaming videos is not protected by the oauth2 mechanism, and only is protected by these one-time tokens.

Would this approach work, or are there better ways to do this?

To simplify my question, I am not asking how to prevent the end user from saving the video on the local machine. I am asking whether it is feasible to prevent a website that is not authorized from embedding the videos on their pages and to make sure that only the sites that are allowed to do so, can do it.

  • Unclear what help you need. Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it’s hard to tell what problem you are trying to solve or what aspect of your approach needs to be corrected or explained. See the How to Ask page for help clarifying this question.
    – gnat
    Commented Aug 6, 2014 at 14:11
  • 1
    The moment you serve the video, people can record it (you're providing them the data feed). There's ways to make this more difficult (isn't there some media encryption proposed for HTML5?), but there's too many ways to "recover" the data on a PC. You're trying to create your own DRM library/scheme/deployment, whereas the big name entertainment companies have spent millions (or billions) of dollars and failed in the long term (and generally just annoyed legitimate users). There's likely a library for baseline protection, but you can't stop determined people. Commented Aug 8, 2014 at 11:05
  • I have updated my question again.
    – akonsu
    Commented Aug 8, 2014 at 19:21
  • 3
    Search for 'prevent hotlinking'. You can't 100% prevent it, but you can make it difficult. Commented Aug 8, 2014 at 19:45
  • @GrandmasterB usually it is done by checking referer header no ? Commented Aug 12, 2014 at 10:09

1 Answer 1


There are HTTP headers for what you are looking for.

  1. Request

The Origin header used by browsers informs of the websites which make the request. If the authorized client foo.com embedded script is stolen, you can detect unauthorized websites and simply return a 401 (Unauthorized) flag.

The Referer header on the HTTP request does a similar job but includes the full path available. For example, for http://www.foo.com/bar the headers will be:

Origin: http://www.foo.com
Referer: http://www.foo.com/bar
  1. Response

The Access-Control-Allow-Origin header informs the browser the intended recipient of the response, if the current website is not the intended one the browser will ignore the response returning a error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.