How to protect a video streaming url by hiding or masking it?

Question

I need to add a video player to my website that will play content from video streaming (YouTube Live, Azure Media Services or any streaming services from a hosting company).

The player will be visible only to authenticated users, but as the streaming URL won't change, I needed to hide it from the user (maybe using DNS configuration in my domain or something else).

Do you know a way to protect the streaming URL?

Answer 1

Given the requirement that you do not want people to see the video even if they have gotten the URL (“so people that don't have signed up to my Web seminar won't be able to watch it”), and given that the player is available only to authenticated users, I have a suggestion:

1. Create a unique URL at your domain for each video stream.

2. When a user hits the URL of the stream, do the following:

   1. Use your authentication logic to see if the user has permission.

   2. If the user has permission, use a 301 or pass the stream through to the player.

   3. If the user does not have permission, redirect the user to the login page (or whatever).

3. Repeat.

From experience, once you get much beyond that level of complexity you need to start looking at services that do this as their business model. Otherwise you run the risk of falling into the rabbit hole.

The caveat here is that once the user has the stream, a motivated person can still identify the source URL and do whatever with it.