title: Private HTTP Live Streaming via CloudFront
body: <p>I am working on an <strong>iOS app</strong> which allows downloading and <strong>HTTP live streaming</strong> of <strong>private videos</strong>. The videos are stored in an Amazon S3 bucket (as <code>mp4</code> and segmented as <code>m3u8</code>/<code>ts</code> files). Also <strong>CloudFront</strong> is turned on and connected to the bucket.</p>
  
  <p>Since the content is private, I need to sign the URLs when connecting via CloudFront. In order to sign the URLs it's necessary to use the private key and therefore it's not possible to generate signed URLs in the iOS app without storing the private key in the bundle. And that would be a bad idea!</p>
  
  <p>So I decided to write a simple Ruby server, which performs the URL signing and redirects to the generated signed CloudFront URL as follows:</p>
  
  <hr>
  
  <p><strong><a href="http://signing.server.local/videos/1.mp4" rel="noreferrer">http://signing.server.local/videos/1.mp4</a></strong> → <strong><a href="https://acbdefg123456.cloudfront.net/videos/1.mp4??Expires=XXX&amp;Signature=XXX&amp;Key-Pair-Id=XXX" rel="noreferrer">https://acbdefg123456.cloudfront.net/videos/1.mp4??Expires=XXX&amp;Signature=XXX&amp;Key-Pair-Id=XXX</a></strong></p>
  
  <p><strong><a href="http://signing.server.local/videos/1.m3u8" rel="noreferrer">http://signing.server.local/videos/1.m3u8</a></strong> → <strong><a href="https://acbdefg123456.cloudfront.net/videos/1.m3u8??Expires=XXX&amp;Signature=XXX&amp;Key-Pair-Id=XXX" rel="noreferrer">https://acbdefg123456.cloudfront.net/videos/1.m3u8??Expires=XXX&amp;Signature=XXX&amp;Key-Pair-Id=XXX</a></strong></p>
  
  <hr>
  
  <p>For video downloads it works well, since there is only one request. But when I want the content streamed and give the <code>MPMoviePlayerController</code> the URL of the signing server, only the first request is signed by the server and redirected to CloudFront. For the next requests the <code>MPMoviePlayerController</code> takes the first signed CloudFront URL as the base and tries to connect directly without going throw the signing server.</p>
  
  <p>The paths in the <code>m3u8</code> files are <strong>relative</strong>.</p>
  
  <p>Any suggestions how to implement this feature without the need to send all the content through the signing server?</p>