Hiding the video url

chrisj

When a video is ready to be played, thru my php website, this shows in the browser:

So, the video url doesn't appear in the browser, the video(mp4) plays in the flowplayer that pops-up in a box over the page, but you can right-click (in Chrome) "Copy video URL", so someone could simply copy the url and play it over and over using my data transfer cost.

Can a random string be added to the file name via the player, or something, so the theif doesn't have the correct path/link? Or any suggestions?

johanafm

One of many ways of doing this. When the page containing the video is requested, you generate a unique url for the video which remains valid for a limited time, such as 30 minutes. If someone scrapes the media url, it will only work for 30 minutes.

You could also store the ip of the client ($_SERVER['REMOTE_ADDR']) requesting the page, and only allow access to the video for that specific url if the request comes from that same ip address. This would only allow sharing of the same video url (within the time-limit frame), for requests sharing the same ip.

sneakyimp

I think the trick here is to have your flowplayer refer not directly to a video but rather to a PHP script that first checks session information and only then sends the video data to the user. Checking the session information means that you can have the original link time out as Johanafm suggested. Basically, you need for a visitor to establish a session by visiting your page in a browser. Once the user has visited your main page, you detect what their IP address is, assign them a session id, check the time, etc. Then the flowplayer displayed in that page can be configured to point to some other page, e.g. video_feed.php which looks at the user session and only coughs up the video if the session information matches. If you want to be really tricky, you can generate a unique id in your first php page and then have flowplayer request the video with that unique id then video_feed.php can check if that unique id has been stored in session. If it has not, then no video for the user!