# Adding SecureToken protection to JW player

**URL:** <https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74>\
**Category:** Wowza Streaming Engine\
**Created:** [July 16, 2008, 1:38pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74 "2008-07-16T13:38:11Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 25, 2008, 2:22pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/21 "2008-12-25T14:22:59Z")

</div>

Edit com.jeroenwijering.player.Player.as

Change:

```auto
token:undefined,

```

To:

```auto
token:"YourSecretToken",

```

Then in Wowza, in the Properties at the bottom of your Application.xml, match the token:

```auto
<Properties>
<!-- Properties defined here will be added to the IApplication.getProperties() and IApplicationInstance.getProperties() collections -->
	<Property>
		<Name>secureTokenSharedSecret</Name>
		<Value>YourSecretToken</Value>
	</Property>
</Properties>

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 29, 2008, 12:41pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/22 "2008-12-29T12:41:43Z")

</div>

Take a look at StorageDir in the Application.xml. This is where Wowza is looking for the video:

```auto
<Streams>
	<StreamType>default</StreamType>
	<StorageDir>${com.wowza.wms.ConfigHome}/content</StorageDir>
</Streams>

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [April 6, 2009, 3:28pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/23 "2009-04-06T15:28:53Z")

</div>

If SecureToken module is set up on the Wowza app you are connecting to with JW player, you just have to match the tokens. The one in Application.xml and the “token” Flashvar in JW Player

It’s setup already in recent JW player versions. Modify the “token” Flashvar in com.jeroenwijering.player.Player.as, rather than in your html. Look for:

```auto
token:undefined,

```

change to

```auto
token:'yourSecretToken',

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [April 6, 2009, 4:19pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/24 "2009-04-06T16:19:27Z")

</div>

Yes, do it that way.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [April 8, 2009, 10:15am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/25 "2009-04-08T10:15:32Z")

</div>

I think the instructions at the beginning of this post were written for a previous version of JW Player. All you should have to do is add your token to Player.as. That’s what I do anyway. You don’t have to modify RTMPModel.as for securetoken.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [August 27, 2009, 10:21pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/26 "2009-08-27T22:21:56Z")

</div>

I downloaded version 4.5, and the instructions at the top of this thread still work, that’s how you should do it.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [September 6, 2009, 4:38pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/27 "2009-09-06T16:38:03Z")

</div>

Download the MediaSecurity Addon Package here:

[http://community.wowza.com/t/-/45](http://community.wowza.com/t/-/45)

And look at:

package/client/securetoken.fla

package/client/fastplaysecure.fla

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [September 8, 2009, 12:17pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/28 "2009-09-08T12:17:25Z")

</div>

Yes, that is correct.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [September 8, 2009, 6:38pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/29 "2009-09-08T18:38:12Z")

</div>

There is another layer you can add that should address this concern: Hotlink denial. This the server-side version;

[https://www.wowza.com/forums/showthread.php?t=5239](https://www.wowza.com/forums/showthread.php?t=5239)

And this is a client-side version:

```auto
if (ExternalInterface.available)
{
var loc:String = ExternalInterface.call("function(){return window.location.href;}");
trace("This player served from: " + loc); // you can do client-side hotlink denial here
}

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [October 14, 2009, 12:07pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/30 "2009-10-14T12:07:59Z")

</div>

I have not had a problem.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 3, 2009, 8:49pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/31 "2009-12-03T20:49:49Z")

</div>

Yes, SecureToken will help prevent downloading of your content. And it will help prevent other players from playing your videos. It is important to use RTMPE protocol.

Hotlinking is another issue, where someone embeds your player on a page in another web site, is sometimes encouraged, but if you don’t want that, this is a solution for that.

[https://www.wowza.com/forums/showthread.php?t=5239](https://www.wowza.com/forums/showthread.php?t=5239)

Still, these are just measures of security.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 4, 2009, 3:14pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/32 "2009-12-04T15:14:07Z")

</div>

There’s nothing in [wowza-install-dir]/examples ?

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 4, 2009, 4:55pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/33 "2009-12-04T16:55:33Z")

</div>

In JW Player 5 RTMPModel.as is now this:

> com.longtailvideo.jwplayer.media.RTMPMediaProvider

The instructions will be the same, the line to edit is about line 229:

\_connection.call(“secureTokenResponse”, null, TEA.decrypt(evt.info.secureToken, config.token));

Also, JW Player 5 is compiled with Flex.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 4, 2009, 6:54pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/34 "2009-12-04T18:54:38Z")

</div>

I’ve did it with Flex Builder 3. Created a new Actionscript project, copied the JW Player source code to /src, then modified the class file as per #4 in your list:

```auto
package {
	import com.longtailvideo.jwplayer.player.Player;
	public class JW50rc1 extends Player
	{
		public function JW50rc1()
		{
		}
	}
}

```

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 5, 2009, 7:26pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/35 "2009-12-05T19:26:04Z")

</div>

I will update the post, but that’s not the issue you are having really. You are not able to compile the new version, so new instructions for secure token won’t help. Work on getting the new environment working, then add SecureToken to the new RTMPMediaProvider file as in previous post.

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [December 5, 2009, 7:35pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/36 "2009-12-05T19:35:51Z")

</div>

Also, having [Flex Builder](http://www.adobe.com/cfusion/entitlement/index.cfm?e=flexbuilder3&sdid=DIPHP) makes it very easy:

Richard

---

<div class="post-metadata">

**Author:** ![Jim\_Baker](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jim\_Baker](https://community.wowza.com/u/Jim_Baker)\
**Post date:** [August 27, 2008, 6:50pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/37 "2008-08-27T18:50:19Z")

</div>

Great instructions and I have implimented it with JW’s version 4.1.60 player so it does work just fine.

Just an aside, I’m not sure the version you used is the same as mine. I say that because the secureTokenResponse callback in the RTMPModel I have is located at line 178

I downloaded the source files from [http://code.jeroenwijering.com/trac/browser/trunk/as3/com](http://code.jeroenwijering.com/trac/browser/trunk/as3/com) and I suspect yours may have come from the [http://www.jeroenwijering.com/?item=JW\_FLV\_Media\_Player](http://www.jeroenwijering.com/?item=JW_FLV_Media_Player) page.

Both you and Jeroen have absolutely great products & support.

Regards - Jimb

---

<div class="post-metadata">

**Author:** ![Jim\_Baker](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jim\_Baker](https://community.wowza.com/u/Jim_Baker)\
**Post date:** [August 31, 2008, 7:05pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/38 "2008-08-31T19:05:11Z")

</div>

Yes you can. I have it running here. You MIGHT also want to look at the Secure URL option. Others her may correct me but as I understand it that option insures that a request to access your sever stream is coming from a domain that you authorized. Coupled with secure token you have an extra layer of security.

Regards - Jimb

---

<div class="post-metadata">

**Author:** ![Jim\_Baker](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@Jim\_Baker](https://community.wowza.com/u/Jim_Baker)\
**Post date:** [April 8, 2009, 2:26am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/39 "2009-04-08T02:26:26Z")

</div>

These issue are fixed in the 4.4.198 version currently available on the JW website. My temporary fix was for 4.4.189

Regards - Jimb

---

<div class="post-metadata">

**Author:** ![Riki\_Babington](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@Riki\_Babington](https://community.wowza.com/u/Riki_Babington)\
**Post date:** [August 28, 2008, 3:56am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/40 "2008-08-28T03:56:27Z")

</div>

yeah the code in the RTMPModel.as is just different now.

On a side note, does this have any performance hit on the server? More importantly does rtmpe have major performance hits over rtmp?

Thanks for your time,

- Riki

[Previous page](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74.md?page=1)

[Next page](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74.md?page=3)