How to encrypt the video URL in flowplayer display?? Created Jun 15, 2009

Encrypting the link won't help much. Once a video is played, it often ends up in the browser cache and a clever user can copy it from there.

But to encrypt a link, you can do that simple:

• have a letter transcription table, so A becomes D, Z becomes Y, etcetera.
• have your Content Management System (often you yourself) rewerite the links like that
• let your server reverse the transcription and send the real file
• or, of course, invent a clever scheme yourself :-)

They're using Amazon's S3 storage, and the S3 querystring authorization

See this page

http://docs.amazonwebservices.com/AmazonS3/latest/index.html?RESTAuthentication.html

It is non-trivial to implement, and, in fact, I have not yet done so successfully.

While I know of no evidence that a streamed video is captured in the user's cache, don't waste time trying to keep folks from copying your video. Use an auth scheme for something practical like keeping your bandwidth costs down.

http://www.xyz.com/flashplayer_low.php?movie=http%3A%2F%2Fxyz.s3
.amazonaws.com%2Fcore-training%2Fstep1-development.flv%3FAWSAc
cessKeyId%3D0NT4QN7M5H0BVQ0QQTR2%26Expires%3D1245032925
%26Signature%3Duq8q5WquZ2gAbEPclVtTRSeORFw%253D

This url is not encrypted, it is just urlencoded. you could paste that url into the browser address bar and it would work.

Making an expiring link like Amazon provide is more tricky.

You'll see they have three variables in the querystring:
AWSAccessKeyId=D0NT4QN7M5H0BVQ0QQTR2 (from your S3 account)
Expires=1245032925 (this is probably a timestamp value)
Signature=uq8q5WquZ2gAbEPclVtTRSeORFw

The 'Signature' is the part that makes it secure. This will be a secure hash of the string concatenation of the first two values together with a third secret salt value. (The salt makes it impossible for people to generate their own signature)

When the server processes one of these links it can first check that the expiry date hasn't been tampered with by computing the signature - if the computed signature matches the one supplied in the url then it hasn't been tampered with. If it's legit the server can then check if the link is still valid according to the expiry date and serve the file or not.

That's just the video server side. You then need code in your page to generate valid links to the video files, according to the rules above.

It's not super difficult and it can prevent other sites from hot-linking your videos, but any user with a valid link will still be able to find a way to download the video file I would imagine.