video file download issue

Question

Hello everyone,

I am using VSTS 2008 + C# + .Net 3.5 + Silverlight 3.0 + ASP.Net to develop a Silverlight application (a video media player) in browser and the function is simple, just use MediaElement to play a remote video file.

The remote server is Windows Server 2008 + IIS 7.0 + IIS Media Bit Rate Throttling Control.

Since the request media URL can be discovered (e.g. from traffic sniffer), and I want to know how to prevent from download directly from the Url? i.e. I want end user to use my Silverlight media player application in browser to play the file, prevent them from download to local directly. Any easy and quick solution or reference code/documents?

thanks in advance, George

Answer 1

1. Use the ASP.NET Authentication Service to authenticate/authorize your user
2. Put the video in a folder where the web.config prevents un-authenticated access to the contents

If I'm not mistaken (and to be truthful, there is a chance as I've never tried this particular scenario) ... that will protect your video content, while allowing the authorized user to access it via silverlight.

Answer 2

What Joel suggested above could make sense. Especially if the Silverlight hosting web application was running in an app pool that ran under a particular identity (i.e. "svcMyVideoApp"). Then you could make it where only this identity could access the content folder. Set all other requests for content to deny (except maybe your own :) )

Answer 3

If i'm not mistaken... if properly set up, IIS 7's media services shouldn't even serve the raw files no more then it should serve a raw unprocessed "aspx" page.

I only played with this a little a few months back, but when I installed the Media plugin for IIS 7, it was not serving the raw media files, and I could only access them via a silverlight interface. I used Expression Studio to create my silverlight viewer page and had it encode it for "smooth streaming".

Answer 4

I might be clutching at straws here but what about using a HTTP handler to intercept requests to the media URL: When the HTTP handler encounters a request, it checks for a unique HTTP header in the request - this could be hard coded into your media player application so that the URL request is accompanied with the appropriate security header - and unless the HTTP header is present then all response is blocked. I know there are no code specifics here but it's an idea all the same.

Answer 5

A simple way would be to add a handler to catch the request like @pb said. I don't know if sending headers is the right thing or not though. A simple way would to just check if the request has a referrer..

String.IsNullOrEmpty(context.Request.ServerVariables["HTTP_REFERER"])

or you'll need authentication and to send the auth cookie with the request.