How can I grant access only if resource is accessed through my domain?

Question

I have a bunch of videos and all of them are uploaded on Wistia. On Wistia, I have set up access for my domain, so they will play only when the videos are fetched from my domain.

If someone uses View Source and copies the video URL and pastes it in a separate browser window, they get an "access denied' message.

I'm thinking about moving my videos to Google Cloud Storage. So, my questions are:

1. Does Google cloud provide a similar domain restriction feature?
2. How can I set this up? For now, I've created a temporary bucket and uploaded a video and granted it public access. Then I copied the public link of the MP4 file and added to my website, and it obviously plays, but then any paid member can use View Source, copy the MP4 link and upload it to other streaming services for everyone to see.

EDIT Is there a way to do this programmatically - like my website is in PHP - so something along the lines like - keep the bucket as restricted access and then through PHP - pass some key and retrieve the video file. Not sure if something like this is possible.

Thanks

Answer 1

I do not believe that there is an access control mechanism in Google Cloud Storage equivalent to the one you are using in Wistia.

There are several methods to restrict object access (see https://cloud.google.com/storage/docs/access-control) in GCS, but none of them are based upon where the request came from. The only one that kind of addresses your issue is to use Signed URLs. Basically, a user would go to your site, but instead of giving them the "real" URL of the object they are going to be using, your application retrieves a special URL that is time-limited. You can set the length of time it is valid for.

But if what you are worried about is people copying your video, presumably they could still see the URL someplace and copy the data from there if they did it immediately, so I don't think that really solves your problem.

Sorry I can't be more helpful.