• Skip to content
  • Skip to primary sidebar
  • Skip to footer

Foliovision

Main navigation

  • Weblog
    • FV Player
    • WordPress
    • Video of the Week
    • Case Studies
    • Business
  • About
    • Testimonials
    • Meet the Team
    • We Support
    • Careers
    • Contact
    • Pricing
  • Products
  • Support
    • FV Player Docs
    • Pro Support
  • Login
  • Basket is empty

Protecting HLS files from hotlinking

Foliovision › Forums › FV Player › Troubleshooting › Protecting HLS files from hotlinking

  • Nasruddin 9 years ago

    Hello Martin,

    Current Stage: I am attempting to play HLS only from S3 bucket with the availability of AWS documentation on editing the S3 bucket policy

    According to the AWS document, rather than making the HLS files public or add permission to “everyone” for open/download files, they recommend to remain S3 bucket with the default private. Permission to allow open/download are configured through bucket policy as below (sample):

    ——————-sample hotlinking protection———–
    How to protect your amazon s3 files from hotlinking.

    {
    “Version”: “2008-10-17”,
    “Id”: “preventHotLinking”,
    “Statement”: [
    {
    “Sid”: “1”,
    “Effect”: “Allow”,
    “Principal”: {
    “AWS”: “*”
    },
    “Action”: “s3:GetObject”,
    “Resource”: “arn:aws:s3:::my-brand-new-bucket/*”,
    “Condition”: {
    “StringLike”: {
    “aws:Referer”: [
    “http://yourwebsitename.com/*”,
    “http://www.yourwebsitename.com/*”
    ]
    }
    }
    }
    ]
    }
    —————————————————–
    Action: I have followed the instructions
    Results:
    1) Desktop – HLS video is playing well on my Google Chrome
    2) Android – Video is not playing (video file not found) – Issue
    3) Signed URLs are not generated any more to the m3u8 file
    Inspections: I found out from the android, it could be due to google chrome or FV player itself not able to send out HTTP referer ( value is NULL) to S3 bucket, that explains,
    Question: How to add FV Player to send the HTTP referer out

    If you can solve this, I will be able to proceed deploying my LMS out to my students before mid of this month as promised.. Please help. I need this one urgent..

    I also read from other support post forums, You mentioned that the team is working on the encryption, no issue with the downloading as the player will not play. However for me that still be a bigissue as people can still hotlinking and cost the owner with the bandwidth. Do you know when this feature will be released. Plus with the hotlinking protections woud be extra advantage to foliovision

    Regards,
    Nash

Viewing 15 replies - 1 through 15 (of 15 total)
  • Nasruddin 9 years ago

    Is there any update?

    Martin 9 years ago

    Hello Nasruddin,

    we are concentrating on the HLS encryption, rather than figuring out the hotlinking protection for it. The issue is that you can add the signature for the M3U8 URLs, but not for the TS video segments.

    You can hotlink to the encrypted HLS stream but it won’t play as the player won’t get the decryption key. That can be based on your login status for example – so only members can play the videos that way.

    Thanks,
    Martin

    Nasruddin 9 years ago

    Hello Martin,
    I am new to FV Player. Is the module HLS encryption ready? I am looking forward to implement it.

    If it is not, do you know when? Are you able to help me now. Interim to resolve why http referer not sending out on the android. Desktop is working fine – Both are with Chrome.

    Thanks,
    Nash.

    Martin 9 years ago

    Hello Nash,

    we were slowed down by Vimeo issues, the our server issues and we are just closing some remaining tasks now, so hopefully we can get started n HLS encryption at last.

    The Android HLS referrer is a problem. I checked on Android 4.3 and it’s not present in the Request Headers for the m3u8 files. What’s worse is that it doesn’t send the cookies either. That might make implementing our encrypted HLS harder.

    Thanks,
    Martin

    Nasruddin 9 years ago

    Hi Martin,
    Thank you for your response. AES is challenging and Foliovision going to be hit once this product is ready. I will follow the development progress.

    In the meantime, I will stop HLS and focus only on RMTP. Will get my students to download Flash browser for Androids as temporary solutions.

    However i do knot have much knowledge for RMTP on IOS. Does it needs flash also?

    Martin 9 years ago

    Hello Nash,

    you would need some app for iOS to play RTMP streams on it.

    Thanks,
    Martin

    Martin 9 years ago

    Hello Nash,

    we have a working Encrypted HLS stream with key distribution via our player: https://foliovision.com/player/demos/encrypted-hls-stream

    Next we need to document the process and add a tool to generate the decryption keys into our plugin.

    Thanks,
    Martin

    Nasruddin 9 years ago

    Hi,
    This is a great news. May I know where do you plan to keep the key- in AWS?. Can we keep it @ our website database.

    Can we put the encrypted ts files and the key other than AWS and play with your fvplayer.

    Regards,
    Nash.

    Martin 9 years ago

    Hello Nash,

    the key is kept in the website database. Even if you get a tool to download the TS segments from a m3u8 file and put them all together the resulting video won’t play as it will remain encrypted.

    Thanks,
    Martin

    Nasruddin 9 years ago

    Martin,
    Any chance I can get the HowTO document and try out.

    Regards,
    Nash.

    Martin 9 years ago

    Hello Nash,

    as a part of the process you have to decode the decryption key, so we are looking into how we could make it part of our plugin to ease up the workflow for our users.

    We will be in touch once that is ready.

    Thanks,
    Martin

    Joel 9 years ago

    Did you guys get this figured how in the plugin yet?

    Martin 9 years ago

    Hello Joel,

    we recommend using encrypted HLS streams. A guide for that can be found here: https://foliovision.com/player/video-hosting/securing-your-video/hls-stream

    Make sure you switch FV Player Pro to Beta version to use this feature: https://foliovision.com/2016/06/switching-pro-player-to-beta

    Thanks,
    Martin

    Joel P. 9 years ago

    Thanks….so tell me every time we have a video that we want to do this with….how much setup time do we have to deploy each video. I see the steps are quite long.

    After you do it once will each video after be faster or do you have to follow all the steps as outline for each video?

    I just ask because we are doing a product launch next week and may have 20 videos and are trying to decide if we have enough time to do that with every single video.

    Thanks…

    Martin 9 years ago

    Hello Joel,

    once you setup the Elastic Transcoder pipeline the steps to repeat for each video are: 6., 7., 8., 9., 10., 11., 13., 14.

    It’s not easy to setup, but adding more videos is easier.

    Thanks,
    Martin

Viewing 15 replies - 1 through 15 (of 15 total)
Reply To: Protecting HLS files from hotlinking



Please Sign in or Register to upload files.

Related Posts

  1. How to Protect Your Videos from Being Downloaded

  2. Microsoft Windows Hidden Files

    Microsoft Windows Hidden Files

  3. Serving Private Videos via CloudFront

Primary Sidebar

Sign in Register
FV Player Docs Post New Topic

Welcome

to Foliovision support forums! We'll be happy to provide free support to resolve all the reported bugs. You always can start by specifying your OS and browser and steps to reproduce the bug.

If you need help with the installation on your site, please submit a request for a Pro Support Incident. We'll have you up and running in no time, with detailed instructions on how to resolve your issue yourself in the future.

Facing a hard to solve WordPress problem? On a tight deadline?

Let us take care of it for you
right now.

Pro Support Buy FV Player

Footer

Our Plugins

  • FV WordPress Flowplayer
  • FV Thoughtful Comments
  • FV Simpler SEO
  • FV Antispam
  • FV Gravatar Cache
  • FV Testimonials

Free Tools

  • Pandoc Online
  • Article spinner
  • WordPress Password Finder
  • Delete LinkedIn Account
  • Responsive Design Calculator
Foliovision logo
All materials © 2025 Foliovision s.r.o. | Panská 12 - 81101 Bratislava - Slovakia | info@foliovision.com
  • This Site Uses Cookies
  • Privacy Policy
  • Terms of Service
  • Site Map
  • Contact
  • Tel. ‭+421 2/5292 0086‬

We are using cookies to give you the best experience on our website.

You can find out more about which cookies we are using or switch them off in .

Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.

Necessary Cookies

Strictly Necessary Cookie allow you to log in and download your software or post to forums.

We use the WordPress login cookie and the session cookie.

If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again.

Support Cookies

Foliovision.com uses self-hosted Rocket.chat and self-hosted Freescout support desk to provide support for FV Player users. These cookies allow our visitors to chat with us and/or submit support tickets.

We are delighted to recommend self-hosted Rocket.chat and especially Freescout to other privacy-conscious independent publishers who would prefer to self-host support.

Please enable Strictly Necessary Cookies first so that we can save your preferences!

3rd Party Cookies

This website uses Google Analytics and Statcounter to collect anonymous information such as the number of visitors to the site, and the most popular pages.

Keeping this cookie enabled helps us to improve our website.

We reluctantly use Google Analytics as it helps us to test FV Player against popular Google Analytics features. Feel free to turn off these cookies if they make you feel uncomfortable.

Statcounter is an independent Irish stats service which we have been using since the beginning of recorded time, sixteen years ago.

Please enable Strictly Necessary Cookies first so that we can save your preferences!