Wowza Community

Adding SecureToken protection to JW player

There is another layer you can add that should address this concern: Hotlink denial. This the server-side version;

http://www.wowza.com/forums/showthread.php?t=5239

And this is a client-side version:

if (ExternalInterface.available)
{
var loc:String = ExternalInterface.call("function(){return window.location.href;}");
trace("This player served from: " + loc); // you can do client-side hotlink denial here
}

Richard

I have not had a problem.

Richard

Yes, SecureToken will help prevent downloading of your content. And it will help prevent other players from playing your videos. It is important to use RTMPE protocol.

Hotlinking is another issue, where someone embeds your player on a page in another web site, is sometimes encouraged, but if you don’t want that, this is a solution for that.

http://www.wowza.com/forums/showthread.php?t=5239

Still, these are just measures of security.

Richard

There’s nothing in [wowza-install-dir]/examples ?

Richard

In JW Player 5 RTMPModel.as is now this:

com.longtailvideo.jwplayer.media.RTMPMediaProvider

The instructions will be the same, the line to edit is about line 229:

_connection.call(“secureTokenResponse”, null, TEA.decrypt(evt.info.secureToken, config.token));

Also, JW Player 5 is compiled with Flex.

Richard

I’ve did it with Flex Builder 3. Created a new Actionscript project, copied the JW Player source code to /src, then modified the class file as per #4 in your list:

package {
	import com.longtailvideo.jwplayer.player.Player;
	public class JW50rc1 extends Player
	{
		public function JW50rc1()
		{
		}
	}
}

Richard

I will update the post, but that’s not the issue you are having really. You are not able to compile the new version, so new instructions for secure token won’t help. Work on getting the new environment working, then add SecureToken to the new RTMPMediaProvider file as in previous post.

Richard

Also, having Flex Builder makes it very easy:

Richard

Great instructions and I have implimented it with JW’s version 4.1.60 player so it does work just fine.

Just an aside, I’m not sure the version you used is the same as mine. I say that because the secureTokenResponse callback in the RTMPModel I have is located at line 178

I downloaded the source files from http://code.jeroenwijering.com/trac/browser/trunk/as3/com and I suspect yours may have come from the http://www.jeroenwijering.com/?item=JW_FLV_Media_Player page.

Both you and Jeroen have absolutely great products & support.

Regards - Jimb

Yes you can. I have it running here. You MIGHT also want to look at the Secure URL option. Others her may correct me but as I understand it that option insures that a request to access your sever stream is coming from a domain that you authorized. Coupled with secure token you have an extra layer of security.

Regards - Jimb

These issue are fixed in the 4.4.198 version currently available on the JW website. My temporary fix was for 4.4.189

Regards - Jimb

yeah the code in the RTMPModel.as is just different now.

On a side note, does this have any performance hit on the server? More importantly does rtmpe have major performance hits over rtmp?

Thanks for your time,

  • Riki

Thanks Charlie, I appreciate the hard work and support!

  • Riki

I think the instructions at the beginning of this post were written for a previous version of JW Player. All you should have to do is add your token to Player.as. That’s what I do anyway. You don’t have to modify RTMPModel.as for securetoken.

Richard

can you give a little instructions on what you did, will it works for jw 4.5 also?

Thanks (i am now trying to understand all this)

I downloaded version 4.5, and the instructions at the top of this thread still work, that’s how you should do it.

Richard

i am not seeing [wowza-pro-install-dir]/examples/SecureToken

i have 1.7.2

Does this work for EC2 as well? I think I’m on version 1.1.4

where’d you find the SecureToken example in the instance??

Hi there

I used the instructions at the beginning of this thread. I changed this portion of the RTMPModel file to

/** Receive NetStream status updates. **/
	private function statusHandler(evt:NetStatusEvent):void {
		if(evt.info.code == "NetConnection.Connect.Success") {
			if (evt.info.secureToken != undefined) {
				connection.call("secureTokenResponse",null,
					//TEA.decrypt(evt.info.secureToken,model.config['token']));
					TEA.decrypt(evt.info.secureToken,"#ed%h0#w@1"));
			}
			// connection.call("checkBandwidth",null);
			// For FMS3 bandwidth checking, uncomment the line above and comment the one below.
			setStream();
			// If you use Limelight/Akamai: comment the line above and uncomment the one below.
			// timeout = setInterval(subscribe,2000,model.playlist[model.config['item']]['file']);
		} else if(evt.info.code == "NetStream.Seek.Notify") {
			clearInterval(timeinterval);
			timeinterval = setInterval(timeHandler,100);
		} else if(evt.info.code == "NetStream.Play.StreamNotFound" || 
			evt.info.code == "NetConnection.Connect.Rejected" || 
			evt.info.code == "NetConnection.Connect.Failed") {
			stop();
			model.sendEvent(ModelEvent.ERROR,{message:"Stream not found: "+
				model.playlist[model.config['item']]['file']});
		} else { 
			model.sendEvent(ModelEvent.META,{info:evt.info.code});
		}
	};

but everytime I try to connect to the readmehtml page I get this error

TypeError: Error #1009: Cannot access a property or method of a null object reference.
	at com.jeroenwijering.utils::TEA$/::strToChars()
	at com.jeroenwijering.utils::TEA$/decrypt()
	at com.jeroenwijering.models::RTMPModel/::statusHandler()

This is how I embed the file into the page

	<script type="text/javascript" src="swfobject.js"></script>
	<script type="text/javascript">
		var s1 = new SWFObject("player.swf","ply","328","200","9","#FFFFFF");
		s1.addParam("allowfullscreen","true");
		s1.addParam("allowscriptaccess","always");
		s1.addParam("flashvars","fullscreen=true&streamer=rtmp://72.9.154.102/securetoken&file=Extremists.flv");
		s1.write("container");
	</script>

I used flash cs3 to generate a new player.swf file. Any ideas, please help! :smiley:

Hi guys,

I found a new player online which supports html, image, flash and flv ads in pre-post-mid rolls… i thinks its better…

Link – > www.hitasoft.com

Regards,

J

I implemented Secure Token with the JW Player, but it seems with Replay Media Catcher 3.01 the media is still downloaded. Am I doing something wrong or is the latest version of RMC immune to secure token in Wowza?