Prevent downloading encrypted content with Firefox video download helper extension about http-streaming HOT 14 CLOSED

We are using a proxy for our video requests which enables us to set security credentials on the request header by implementing:

videojs.Hls.xhr.beforeRequest = function(options) {}

... as recently described here: videojs/videojs-contrib-hls#1337 (comment)

The problem with that approach is that you will need to override the native HLS tech (provided by Safari and Edge) which leads to this confirmed issue:
videojs/videojs-contrib-hls#1360

It seems to be a bit of a catch-22 - unless someone else has any bright ideas?

from http-streaming.

Hi @daliwell

I am not sure if you are using AWS I have been googling around on ways to modify the headers https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront

Maybe you can point me in the right direction.

Thanks

from http-streaming.

Hey @samueleastdev - adding security headers is straightforward. Just add them to the XHR in your implementation of that function. Something like:

videojs.Hls.xhr.beforeRequest = function (opt) {
  opt.withCredentials = false;
  opt.headers = {};
  opt.headers['x-my-security-header'] = 'my token';
  return opt;
};

from http-streaming.

Thanks, @daliwell makes sense didn't know you could do this ;)

from http-streaming.

Thanks, @daliwell all setup and working the Safari issue seems to be a bit of a pain and a few people also having issues: https://github.com/videojs/videojs-contrib-hls/issues/1389

The problem being you change the key location to the proxy url in the manifest so you can set the request headers with beforeRequest and this function is not being called in Safari because is defaulting to Native HLS so you cannot set the header for Safari to grab the key.

Indeed catch 22 fixed the extension and downloading issues but now the player won't work in Safari which ironically is the best browser to prevent extensions and add-ons downloading your media.

Did you have any ideas on this? maybe something I can try

from http-streaming.

Hey @samueleastdev - Actually we always override the native player tech (no matter what the browser) so we can set a security header on the request. We request the actual (unencrypted) content on S3, residing in a private bucket. Our proxy is in the same VPC and deals with the inbound request (checking the security header). So basically even if you have the correct URL, that URL won't "work" unless you are a logged in, authenticated user.

This seems to work fine for us, apart from there being some rendering problems in contrib-hls on Edge and Safari if the play head is moved to anywhere in the video that isn't coincident with a key frame (so normally anywhere in a 10s segment apart from the very beginning). This only seems to happen on Safari and Edge when using contrib-HLS for playback (so non-native). My understanding is that Safari and Edge non-native playback has not been tested to the same level as on Chrome and Firefox as the native playback works on Safari and Edge.

So for us at least, override native always seems to work on Safari (or Edge) desktop, apart from this rendering issue, which sorts itself our after (max) 10 seconds. If a user tries to access a video on mobile (e.g. via safari) we will redirect the user to one of our native apps.

I hope this helps in some way? Ideally, it would be great if non-native Safari and Edge playback could be given the same amount of attention as non-native Chrome and Firefox playback ;)

from http-streaming.

Hi @daliwell

Thanks for the info appreciate it ;)

I take it these are the same issues you are seeing in Safari with non-native playback stuttering and pixelating?

We haven't quite got around to native apps yet this is something we are working on.

from http-streaming.

Yes - same but different and only on Edge and Safari (Chrome and Firefox play perfectly every time).

from http-streaming.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

from http-streaming.

Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.

from http-streaming.

Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.

Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!

from http-streaming.

Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.

Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!

No, I took some examples from the posts above and am trying to figure out how to block the download. Could you share an example of what you mentioned if it doesn't bother you?
I would appreciate it very much.

from http-streaming.

Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.

Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!

No, I took some examples from the posts above and am trying to figure out how to block the download. Could you share an example of what you mentioned if it doesn't bother you?
I would appreciate it very much.

Oh so your problem is the Firefox will automatically download your media once user access the page? Or you want to prevent user to not able to decrypt downloaded media?

My case is not about downloadable, it's about decryption!
Sure I can share you some information PM me please as it's not comfortable to public production one!

from http-streaming.

has anyone managed it?

from http-streaming.