Hello, you know on YouTube, once you uploaded a video, it would ask you to make it either public or private. public being that it is accessible by any. private being accissible by only you the original uploader and you have to be logged in to do so, too. I need to make something of the same kind as that. I am making a rails app that uses QuickTime progressive download instead of Flash, so basically I use an embed tag with the src pointing to some dns/video.mov. But I can't possibly let the videos be on the public domain. What can be my options on top of your head?
A:
Create a session cookie when the user logs in. This cookie usually contains a session ID of some kind (a long string). Attach that ID to the URL of the movie as a query (.../video.mov?ID=2387543462578).
That way, your server can check the ID against currently open sessions. If the ID isn't valid, reply with a 403 (forbidden).
[EDIT] Since you put the file into Rails_root/public/videos, Ruby automatically handles the download to the browser for you. This is the default behavior for any file put in the public folder. What you need is to put the files in a different place and handle the downloads manually. Check the Ruby sources and look for the handler for the public folder; this should give you an idea how it works under the hoods. You should be able to extend this class with some additional code to check whether the user can actually download the file.
Aaron Digulla
2009-10-02 08:56:02
In my Rails app,there are both authentication and authorization, I can so far tell who can use what action. My impression is that, say, I have a folder with users videos called "video" under Rails_root/public/videos. So abc.mov is accessible now via dns/videos/abc.mov directly in the address bar. Rails doesn't seem to know a thing that this happened. If I don't put the videos in public folder, which can prevent that from happening, but I'd have no way to embed it on a normal user page because the embed has an SRC attrib that I need to supply an url to the video to. How can I use your method?
Nik
2009-10-02 19:44:58
See my edits: You need to add a handler for the other URL, so the video is no longer public for anyone.
Aaron Digulla
2009-10-05 08:00:06