Comments (14)
We are using a proxy for our video requests which enables us to set security credentials on the request header by implementing:
videojs.Hls.xhr.beforeRequest = function(options) {}
... as recently described here: videojs/videojs-contrib-hls#1337 (comment)
The problem with that approach is that you will need to override the native HLS tech (provided by Safari and Edge) which leads to this confirmed issue:
videojs/videojs-contrib-hls#1360
It seems to be a bit of a catch-22 - unless someone else has any bright ideas?
from http-streaming.
Hi @daliwell
I am not sure if you are using AWS I have been googling around on ways to modify the headers https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront
Maybe you can point me in the right direction.
Thanks
from http-streaming.
Hey @samueleastdev - adding security headers is straightforward. Just add them to the XHR in your implementation of that function. Something like:
videojs.Hls.xhr.beforeRequest = function (opt) {
opt.withCredentials = false;
opt.headers = {};
opt.headers['x-my-security-header'] = 'my token';
return opt;
};
from http-streaming.
Thanks, @daliwell makes sense didn't know you could do this ;)
from http-streaming.
Thanks, @daliwell all setup and working the Safari issue seems to be a bit of a pain and a few people also having issues: https://github.com/videojs/videojs-contrib-hls/issues/1389
The problem being you change the key location to the proxy url in the manifest so you can set the request headers with beforeRequest and this function is not being called in Safari because is defaulting to Native HLS so you cannot set the header for Safari to grab the key.
Indeed catch 22 fixed the extension and downloading issues but now the player won't work in Safari which ironically is the best browser to prevent extensions and add-ons downloading your media.
Did you have any ideas on this? maybe something I can try
from http-streaming.
Hey @samueleastdev - Actually we always override the native player tech (no matter what the browser) so we can set a security header on the request. We request the actual (unencrypted) content on S3, residing in a private bucket. Our proxy is in the same VPC and deals with the inbound request (checking the security header). So basically even if you have the correct URL, that URL won't "work" unless you are a logged in, authenticated user.
This seems to work fine for us, apart from there being some rendering problems in contrib-hls on Edge and Safari if the play head is moved to anywhere in the video that isn't coincident with a key frame (so normally anywhere in a 10s segment apart from the very beginning). This only seems to happen on Safari and Edge when using contrib-HLS for playback (so non-native). My understanding is that Safari and Edge non-native playback has not been tested to the same level as on Chrome and Firefox as the native playback works on Safari and Edge.
So for us at least, override native always seems to work on Safari (or Edge) desktop, apart from this rendering issue, which sorts itself our after (max) 10 seconds. If a user tries to access a video on mobile (e.g. via safari) we will redirect the user to one of our native apps.
I hope this helps in some way? Ideally, it would be great if non-native Safari and Edge playback could be given the same amount of attention as non-native Chrome and Firefox playback ;)
from http-streaming.
Hi @daliwell
Thanks for the info appreciate it ;)
I take it these are the same issues you are seeing in Safari with non-native playback stuttering and pixelating?
We haven't quite got around to native apps yet this is something we are working on.
from http-streaming.
Yes - same but different and only on Edge and Safari (Chrome and Firefox play perfectly every time).
from http-streaming.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
from http-streaming.
Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.
from http-streaming.
Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.
Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!
from http-streaming.
Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.
Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!
No, I took some examples from the posts above and am trying to figure out how to block the download. Could you share an example of what you mentioned if it doesn't bother you?
I would appreciate it very much.
from http-streaming.
Could anyone prevent downloading encrypted content with Firefox video download helper extension? I've looked for several streaming services, but none with a solution to it. Currently I am using streaming with flash player, but I have several communication problems in some students due to firewall restrictions.
Are you using AES encryption with the key embedded together with m3u8 file? I have already been working on this and my solution is remove the key there, extend my player code to handle the key instead!
No, I took some examples from the posts above and am trying to figure out how to block the download. Could you share an example of what you mentioned if it doesn't bother you?
I would appreciate it very much.
Oh so your problem is the Firefox will automatically download your media once user access the page? Or you want to prevent user to not able to decrypt downloaded media?
My case is not about downloadable, it's about decryption!
Sure I can share you some information PM me please as it's not comfortable to public production one!
from http-streaming.
has anyone managed it?
from http-streaming.
Related Issues (20)
- HttpStreaming v2.16.3 not build successfully HOT 2
- Support overridenative option dynamically without reload player HOT 1
- Buffering issue while playing content with high bitrate HOT 1
- player.tech() is not available when "xhr-hooks-ready" is called HOT 8
- Support encapsulation of WebVTT in ISO-BMFF HOT 2
- How to get the VOD/live property of the current playing stream from player? HOT 2
- Support for EXT-X-DEFINE in m3u8 files HOT 1
- Memory leak during media source change - [autoplay mode] HOT 2
- Player enters endless seeking state when setting currentTime() to duration() HOT 2
- Stops Requesting TS Files After m3u8 Reset HOT 12
- DRM with DASH is not playing and stuck in loading state HOT 4
- Issue with Playing Multi-Period DASH Stream with Nagra DRM and Google Server-Side Ad Integration HOT 2
- DASH with DAI is not working HOT 2
- How to preload all .ts of m3u8 HOT 2
- DASH playlist cannot scrub forward in time HOT 2
- `xhr-hooks-ready` not working with overrideNative : true HOT 2
- Stream skips back during live stream HOT 2
- JS exceptions when playing m3u8 video streams HOT 2
- add chapter plugin to stream file HOT 1
- Dash non-live stream doesn't play for chrome. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from http-streaming.