title: Flowplayer Secure Streaming with Apache
body: <p><b>Update: </b>This is now a tutorial on how to give some level of security to streaming videos if:<br/>
  1) you are using Flowplayer with Apache<br/>
  2) you don't want users to be able to download the video (streaming only)<br/>
  3) you don't want users to be able to put the URL of the video in the browser (limited access videos)<br/>
  4) you only want users to be able to stream the video if they have the proper credentials</p>
  
  <p>You must have prior knowledge of <strong>PHP</strong> and <strong>.htaccess</strong> files.</p>
  
  <p><b>Original Post:</b><br/>
  My client wants his videos hidden so that they cannot be streamed until they are purchased on his domain (he doesn't want users to be able to download the video either).  I'm trying to do this with Flowplayer's Secure Streaming and I think I'm almost there 9I'm there now!).  After searching everywhere I found <a href="http://www.gpeopl.es/?p=618" rel="noreferrer">this post</a>.</p>
  
  <p>I've restricted hot-linking by other sites via .htaccess now I'm trying to restrict access by someone just copying the url and pasting it in the address bar (i.e. <a href="http://www.mydomain.com/videos/testVideo.mov" rel="noreferrer">http://www.mydomain.com/videos/testVideo.mov</a>)</p>
  
  <p>I've used PHP/AJAX to generate this HTML (most examples out there use the JS Flowplayer Plugin, I'm using the <code>&lt;object&gt;</code> tag to embed the player, no JS involved.  If you use the JS plugin, use that instead of the embedded version, the .htaccess file and the video.php file will be the same.)</p>
  
  <pre><code>$videofilename = 'testVideo.mov';    
  $hash = md5('1234');
  $timestamp = time();
  $videoPath = $hash.'/'.$timestamp.'/'.$videofilename;
  echo '
  &lt;object width="667" height="375" type="application/x-shockwave-flash" data="http://releases.flowplayer.org/swf/flowplayer-3.2.8.swf"&gt;
      &lt;param name="wmode" value="transparent"/&gt;
      &lt;param name="movie" value="../swf/flowplayer.securestreaming-3.2.8.swf" /&gt;
      &lt;param name="allowfullscreen" value="true" /&gt;
      &lt;param name="timestamp" value="'.$timestamp.'" /&gt;
      &lt;param name="token" value="'.$hash.'" /&gt;    
      &lt;param name="streamName" value="'.$videofilename.'" /&gt;      
  
      &lt;param name="flashvars" value=\'config={
          "playlist":[
              {"url": "'.$videoPath.'", "baseUrl": "http://www.mydomain.com/videos", "autoPlay":false,"autoBuffering":true,"bufferLength":5}
              ]
  
          }\' /&gt;
  &lt;/object&gt;';
  </code></pre>
  
  <p>Now in the directory <code>videos</code> I put this .htaccess file:</p>
  
  <pre><code> RewriteEngine on
   RewriteRule ^(.*)/(.*)/(.*)$ http://www.mydomain.com/vidoeos/video.php?h=$1&amp;t=$2&amp;v=$3
   RewriteRule ^$ - [F]
   RewriteRule ^[^/]+\.(mov|mp4)$ - [F]
  </code></pre>
  
  <p><strong>Update:</strong>
  The purpose of the php file is to <strong>1)</strong> get the data hash, timestamp, and video filename (test.mov or whatever) <strong>2)</strong> Make sure everything checks out (I purposely ommitted the security checks in this example for length) and <strong>3)</strong> Give Flowplayer the stream of your video. Make sure the <code>$originaltimestamp</code> and <code>$hash</code> are good before giving access.  You may also check session credentials, get the 'real' file location from a database, or do any kind of php security checking you want before you give the user access. </p>
  
  <p>Also remember to change the <code>Content-type:</code> field so it correlates with the correct file extension (i.e. <code>video/mp4</code> if the video is an *.mp4) </p>
  
  <p>And <code>videos/video.php</code> looks like this:</p>
  
  <pre><code>&lt;?php
  session_start();
  
  $hash = $_GET['h'];
  $streamname = $_GET['v'];
  $originaltimestamp = $_GET['t'];
  
  header('Content-Description: File Transfer');
  header('Content-type: video/quicktime');
  header("Content-length: " . filesize($streamname));
  header("Expires: 0");
  header("Content-Transfer-Encoding: binary");
  
  $file = fopen($streamname, 'r');
  echo stream_get_contents($file);    
  fclose($file);
  ?&gt;
  </code></pre>
  
  <p>Three files total, the <strong>HTML</strong> with the player, the <strong>.htaccess</strong> file and lastly the <strong>video.php</strong> file.  My original problem was the <code>$streamname</code> was wrong.  Remember the <code>$streamname</code> should be the file location after (or under) the BaseUrl. Hope this helps someone like me!</p>
  
  <p>Anyone see security issues with doing it this way?</p>