Wowza Logo Wowza Icon
Wowza Video Sign Out
Talk to an Expert Free Trial
Wowza Video Sign Out

Wowza Community

Adding SecureToken protection to JW player

Wowza Streaming Engine
#21

Edit com.jeroenwijering.player.Player.as

Change:

token:undefined,

To:

token:"YourSecretToken",

Then in Wowza, in the Properties at the bottom of your Application.xml, match the token:

<Properties>
<!-- Properties defined here will be added to the IApplication.getProperties() and IApplicationInstance.getProperties() collections -->
	<Property>
		<Name>secureTokenSharedSecret</Name>
		<Value>YourSecretToken</Value>
	</Property>
</Properties>

Richard

#22

Take a look at StorageDir in the Application.xml. This is where Wowza is looking for the video:

<Streams>
	<StreamType>default</StreamType>
	<StorageDir>${com.wowza.wms.ConfigHome}/content</StorageDir>
</Streams>

Richard

#23

If SecureToken module is set up on the Wowza app you are connecting to with JW player, you just have to match the tokens. The one in Application.xml and the “token” Flashvar in JW Player

It’s setup already in recent JW player versions. Modify the “token” Flashvar in com.jeroenwijering.player.Player.as, rather than in your html. Look for:

token:undefined,

change to

token:'yourSecretToken',

Richard

#24

Yes, do it that way.

Richard

#25

I think the instructions at the beginning of this post were written for a previous version of JW Player. All you should have to do is add your token to Player.as. That’s what I do anyway. You don’t have to modify RTMPModel.as for securetoken.

Richard

#26

I downloaded version 4.5, and the instructions at the top of this thread still work, that’s how you should do it.

Richard

#27

Download the MediaSecurity Addon Package here:

http://www.wowza.com/community/t/-/45

And look at:

package/client/securetoken.fla

package/client/fastplaysecure.fla

Richard

#28

Yes, that is correct.

Richard

#29

There is another layer you can add that should address this concern: Hotlink denial. This the server-side version;

http://www.wowza.com/forums/showthread.php?t=5239

And this is a client-side version:

if (ExternalInterface.available)
{
var loc:String = ExternalInterface.call("function(){return window.location.href;}");
trace("This player served from: " + loc); // you can do client-side hotlink denial here
}

Richard

#30

I have not had a problem.

Richard

#31

Yes, SecureToken will help prevent downloading of your content. And it will help prevent other players from playing your videos. It is important to use RTMPE protocol.

Hotlinking is another issue, where someone embeds your player on a page in another web site, is sometimes encouraged, but if you don’t want that, this is a solution for that.

http://www.wowza.com/forums/showthread.php?t=5239

Still, these are just measures of security.

Richard

#32

There’s nothing in [wowza-install-dir]/examples ?

Richard

#33

In JW Player 5 RTMPModel.as is now this:

com.longtailvideo.jwplayer.media.RTMPMediaProvider

The instructions will be the same, the line to edit is about line 229:

_connection.call(“secureTokenResponse”, null, TEA.decrypt(evt.info.secureToken, config.token));

Also, JW Player 5 is compiled with Flex.

Richard

#34

I’ve did it with Flex Builder 3. Created a new Actionscript project, copied the JW Player source code to /src, then modified the class file as per #4 in your list:

package {
	import com.longtailvideo.jwplayer.player.Player;
	public class JW50rc1 extends Player
	{
		public function JW50rc1()
		{
		}
	}
}

Richard

#35

I will update the post, but that’s not the issue you are having really. You are not able to compile the new version, so new instructions for secure token won’t help. Work on getting the new environment working, then add SecureToken to the new RTMPMediaProvider file as in previous post.

Richard

#36

Also, having Flex Builder makes it very easy:

Richard

#37

Great instructions and I have implimented it with JW’s version 4.1.60 player so it does work just fine.

Just an aside, I’m not sure the version you used is the same as mine. I say that because the secureTokenResponse callback in the RTMPModel I have is located at line 178

I downloaded the source files from http://code.jeroenwijering.com/trac/browser/trunk/as3/com and I suspect yours may have come from the http://www.jeroenwijering.com/?item=JW_FLV_Media_Player page.

Both you and Jeroen have absolutely great products & support.

Regards - Jimb

#38

Yes you can. I have it running here. You MIGHT also want to look at the Secure URL option. Others her may correct me but as I understand it that option insures that a request to access your sever stream is coming from a domain that you authorized. Coupled with secure token you have an extra layer of security.

Regards - Jimb

#39

These issue are fixed in the 4.4.198 version currently available on the JW website. My temporary fix was for 4.4.189

Regards - Jimb

#40

yeah the code in the RTMPModel.as is just different now.

On a side note, does this have any performance hit on the server? More importantly does rtmpe have major performance hits over rtmp?

Thanks for your time,

  • Riki

© 2007–2024 Wowza Media Systems™, LLC. All rights reserved.   Security & Privacy PolicyLegalSystem Status