# Adding SecureToken protection to JW player

**URL:** <https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74>\
**Category:** Wowza Streaming Engine\
**Created:** [July 16, 2008, 1:38pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74 "2008-07-16T13:38:11Z")\
**Posts on this page:** 20\
**Page:** 3

<div class="post-metadata">

**Author:** ![Riki\_Babington](https://avatars.discourse-cdn.com/v4/letter/r/0ea827/32.png) [@Riki\_Babington](https://community.wowza.com/u/Riki_Babington)\
**Post date:** [August 29, 2008, 12:53am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/41 "2008-08-29T00:53:37Z")

</div>

Thanks Charlie, I appreciate the hard work and support!

- Riki

---

<div class="post-metadata">

**Author:** ![Asa\_Pierre](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@Asa\_Pierre](https://community.wowza.com/u/Asa_Pierre)\
**Post date:** [August 27, 2009, 2:16pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/42 "2009-08-27T14:16:45Z")

</div>

> I think the instructions at the beginning of this post were written for a previous version of JW Player. All you should have to do is add your token to Player.as. That’s what I do anyway. You don’t have to modify RTMPModel.as for securetoken.
> 
> Richard

can you give a little instructions on what you did, will it works for jw 4.5 also?

Thanks (i am now trying to understand all this)

---

<div class="post-metadata">

**Author:** ![Asa\_Pierre](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@Asa\_Pierre](https://community.wowza.com/u/Asa_Pierre)\
**Post date:** [September 6, 2009, 10:56am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/43 "2009-09-06T10:56:57Z")

</div>

> I downloaded version 4.5, and the instructions at the top of this thread still work, that’s how you should do it.
> 
> Richard

i am not seeing [wowza-pro-install-dir]/examples/SecureToken

i have 1.7.2

---

<div class="post-metadata">

**Author:** ![Iziah\_Reid](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@Iziah\_Reid](https://community.wowza.com/u/Iziah_Reid)\
**Post date:** [October 6, 2008, 11:28am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/44 "2008-10-06T11:28:50Z")

</div>

Does this work for EC2 as well? I think I’m on version 1.1.4

---

<div class="post-metadata">

**Author:** ![Iziah\_Reid](https://avatars.discourse-cdn.com/v4/letter/i/74df32/32.png) [@Iziah\_Reid](https://community.wowza.com/u/Iziah_Reid)\
**Post date:** [October 6, 2008, 12:00pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/45 "2008-10-06T12:00:03Z")

</div>

where’d you find the SecureToken example in the instance??

---

<div class="post-metadata">

**Author:** ![Rudy\_Cortes](https://avatars.discourse-cdn.com/v4/letter/r/919ad9/32.png) [@Rudy\_Cortes](https://community.wowza.com/u/Rudy_Cortes)\
**Post date:** [October 5, 2008, 7:28pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/46 "2008-10-05T19:28:05Z")

</div>

Hi there

I used the instructions at the beginning of this thread. I changed this portion of the RTMPModel file to

```auto
/ **Receive NetStream status updates.** /
	private function statusHandler(evt:NetStatusEvent):void {
		if(evt.info.code == "NetConnection.Connect.Success") {
			if (evt.info.secureToken != undefined) {
				connection.call("secureTokenResponse",null,
					//TEA.decrypt(evt.info.secureToken,model.config['token']));
					TEA.decrypt(evt.info.secureToken,"#ed%h0#w@1"));
			}
			// connection.call("checkBandwidth",null);
			// For FMS3 bandwidth checking, uncomment the line above and comment the one below.
			setStream();
			// If you use Limelight/Akamai: comment the line above and uncomment the one below.
			// timeout = setInterval(subscribe,2000,model.playlist[model.config['item']]['file']);
		} else if(evt.info.code == "NetStream.Seek.Notify") {
			clearInterval(timeinterval);
			timeinterval = setInterval(timeHandler,100);
		} else if(evt.info.code == "NetStream.Play.StreamNotFound" || 
			evt.info.code == "NetConnection.Connect.Rejected" || 
			evt.info.code == "NetConnection.Connect.Failed") {
			stop();
			model.sendEvent(ModelEvent.ERROR,{message:"Stream not found: "+
				model.playlist[model.config['item']]['file']});
		} else { 
			model.sendEvent(ModelEvent.META,{info:evt.info.code});
		}
	};

```

but everytime I try to connect to the readmehtml page I get this error

```auto
TypeError: Error #1009: Cannot access a property or method of a null object reference.
	at com.jeroenwijering.utils::TEA$/::strToChars()
	at com.jeroenwijering.utils::TEA$/decrypt()
	at com.jeroenwijering.models::RTMPModel/::statusHandler()

```

This is how I embed the file into the page

```auto
	<script type="text/javascript" src="swfobject.js"></script>
	<script type="text/javascript">
		var s1 = new SWFObject("player.swf","ply","328","200","9","#FFFFFF");
		s1.addParam("allowfullscreen","true");
		s1.addParam("allowscriptaccess","always");
		s1.addParam("flashvars","fullscreen=true&streamer=rtmp://72.9.154.102/securetoken&file=Extremists.flv");
		s1.write("container");
	</script>

```

I used flash cs3 to generate a new player.swf file. Any ideas, please help! 😃

---

<div class="post-metadata">

**Author:** ![John\_Peter](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@John\_Peter](https://community.wowza.com/u/John_Peter)\
**Post date:** [October 18, 2008, 3:35am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/47 "2008-10-18T03:35:40Z")

</div>

Hi guys,

I found a new player online which supports html, image, flash and flv ads in pre-post-mid rolls… i thinks its better…

Link – \> www.hitasoft.com

Regards,

J

---

<div class="post-metadata">

**Author:** ![Michael\_McIlmurray](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@Michael\_McIlmurray](https://community.wowza.com/u/Michael_McIlmurray)\
**Post date:** [December 19, 2008, 5:51am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/48 "2008-12-19T05:51:13Z")

</div>

I implemented Secure Token with the JW Player, but it seems with Replay Media Catcher 3.01 the media is still downloaded. Am I doing something wrong or is the latest version of RMC immune to secure token in Wowza?

---

<div class="post-metadata">

**Author:** ![Mohammad\_Usama](https://avatars.discourse-cdn.com/v4/letter/m/d2c977/32.png) [@Mohammad\_Usama](https://community.wowza.com/u/Mohammad_Usama)\
**Post date:** [December 24, 2008, 9:50pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/49 "2008-12-24T21:50:23Z")

</div>

I also am getting the same problem. Whenever I open the readme file and click play, I get this error:

> TypeError: Error #1009: Cannot access a property or method of a null object reference.
> 
> at com.meychi.ascript::TEA$/strToChars()
> 
> at com.meychi.ascript::TEA$/decrypt()
> 
> at com.jeroenwijering.models::RTMPModel/statusHandler()

Wowza reports:

> INFO stream publish Stream1 -
> 
> INFO session connect-pending -
> 
> INFO server comment - SecureTokenTarget: create:true play:false publish:false
> 
> INFO session connect -
> 
> INFO session disconnect 667801055 -

Any ideas? I tried both 4.1 and 4.2

Edit: I am trying to do live broadcasting.

---

<div class="post-metadata">

**Author:** ![Mohammad\_Usama](https://avatars.discourse-cdn.com/v4/letter/m/d2c977/32.png) [@Mohammad\_Usama](https://community.wowza.com/u/Mohammad_Usama)\
**Post date:** [December 29, 2008, 1:29am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/50 "2008-12-29T01:29:54Z")

</div>

I am no longer getting the error message but now jwplayer says: “stream not found: Stream1.flv”

The stream is up and running. Am I supposed to edit the application.xml that’s in the live stream folder?

---

<div class="post-metadata">

**Author:** ![Mohammad\_Usama](https://avatars.discourse-cdn.com/v4/letter/m/d2c977/32.png) [@Mohammad\_Usama](https://community.wowza.com/u/Mohammad_Usama)\
**Post date:** [December 30, 2008, 8:25am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/51 "2008-12-30T08:25:44Z")

</div>

In my wowzainstalldir/livevideo/application.xml I have this:

```auto
<Streams>
			<StreamType>live</StreamType>
			<StorageDir>${com.wowza.wms.AppHome}/content</StorageDir>
			<Properties>
				<!-- Properties defined here will override any properties defined in conf/Streams.xml for any streams types loaded by this application -->
				<!--
				<Property>
					<Name></Name>
					<Value></Value>
				</Property>
				-->
			</Properties>
		</Streams>

```

Is something wrong? I don’t fully understand what’s going on.

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 3, 2009, 12:02pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/52 "2009-12-03T12:02:08Z")

</div>

Hi, Just a simple non technical question.

Will this thread provide me with the knowledge that I need to stream a flv that I have stored in a directory within my web root and prevent people from downloading the flv or hot linking to it? I am using Wowza Media Server Pro10 1.7.2 build12107 and the JW Player was downloaded Sept. 11 2009.

If the answer to the question above is “yes”, does anyone know why anyone would “not” want to protect their files from bandwidth / copyright thievery? Why is this so difficult to achieve? Seems like this should be a web standard. I will definitely use this solution if it achieves what I am trying to do as I have been spending a week of non stop reading trying to figure out how to prevent people from linking to / download my flv file.

Thanks, David

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 4, 2009, 7:10am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/53 "2009-12-04T07:10:59Z")

</div>

Where is this?

> # Download and install Wowza Pro 1.7.2 or greater
> 
> # Install the Wowza Pro SecureToken example by double clicking on [wowza-pro-install-dir]/examples/SecureToken/install.sh (this will setup the Wowza Pro application securetoken with a secureTokenSharedSecret of #ed%h0#w@1)
> 
> I don’t see it in the install rpm I downloaded?
> 
> ```auto
> root@orion [/]# less WowzaMediaServerPro-1.7.2.noarch.rpm | grep -i securet
> root@orion [/]#
> 
> ```

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 4, 2009, 8:42am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/54 "2009-12-04T08:42:34Z")

</div>

Nope, but I just downloaded the MediaSecurity package mentioned in this thread.

I am doing to secure token only for on demand with jw player. Should I use this in the conf?

```auto
                       <Module>
                                <Name>ModuleSecureURLParams</Name>
                                <Description>ModuleSecureURLParams</Description>
                                <Class>com.wowza.wms.plugin.security.ModuleSecureURLParams</Class>
                        </Module>

```

or this?

```auto
                       <Module>
                                <Name>ModuleSecureURLParams</Name>
                                <Description>ModuleSecureURLParams</Description>
                                <Class>com.wowza.wms.plugin.security.ModuleSecureToken</Class>
                        </Module>

```

I have also noticed that the src for jw player 5 does not have the RTMPModel.as file. Do you happen to know of an updated tutorial for this? I have been looking out on the longtail site but no luck yet.

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 4, 2009, 10:24am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/55 "2009-12-04T10:24:19Z")

</div>

I built with flex per the instructions that came with jw player 5 and the resulting swf file is only 1 KB vs the 81 KB player.swf file that comes int he zip. Any idea what I am doing wrong?

Here’s the instructions I am following. I am not sure what step 4 means.

**Instructions:**

To compile with Flex and Ant, enter the following command:

ant -buildfile build\build.xml

If the build is successful, player.swf will appear in the “bin-release” folder.

Alternately, if you’re using Flex Builder or Flash Builder, you may use the following method to build the player:

1. Create a new Actionscript project (you can give it any name except “Player”).

2. Under “Project Contents”, choose the checkout tree (the folder where this README file lives).

3. Click the “Finish” button

**4. Alter your main application class to inherit from com.longtailvideo.jwplayer.player.Player.**

1. Under the “Project” menu, choose “Export Release Build”.

2. The player will be compiled as bin-release/{Your Project Name}.swf.

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 5, 2009, 11:10am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/56 "2009-12-05T11:10:45Z")

</div>

Thanks for your prompt responses.

I tried that and it compiles, however the resultiing swf is still 1 KB. This doesn’t seem right.

Do you or someone else know of or possibly supply a detailed tutorial on how to compile the token into the new version 5 player? I apparently don’t have the foundation needed to peice this together myself.

I think that perhaps this thread should redirect to a more current thread for this new player?

Thanks, David

---

<div class="post-metadata">

**Author:** ![David\_Mathis](https://avatars.discourse-cdn.com/v4/letter/d/919ad9/32.png) [@David\_Mathis](https://community.wowza.com/u/David_Mathis)\
**Post date:** [December 5, 2009, 7:51pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/57 "2009-12-05T19:51:51Z")

</div>

Yes, you’re right, I just found the parts about rebuilding the player out of date and confusing. This is my first time compiling a flash app.

I will be heading over to the longtail site and asking some questions too.

Thanks for all of your help.

---

<div class="post-metadata">

**Author:** ![Riki\_Babington1](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@Riki\_Babington1](https://community.wowza.com/u/Riki_Babington1)\
**Post date:** [April 6, 2009, 9:11am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/58 "2009-04-06T09:11:38Z")

</div>

I tried this with the new MediaSecurity package and its not working. Is there anything special that needs to be done to get a secure tolken to work with wowza 1.7 and jw player 4.4?

---

<div class="post-metadata">

**Author:** ![Riki\_Babington1](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@Riki\_Babington1](https://community.wowza.com/u/Riki_Babington1)\
**Post date:** [April 6, 2009, 10:15am UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/59 "2009-04-06T10:15:38Z")

</div>

I think I may see the problem. I didnt read anywhere in the documentation for setting up a secure token only.

It told me to add this:

```auto
<Module>
<Name>ModuleSecureURLParams</Name>
<Description>ModuleSecureURLParams</Description>
<Class>com.wowza.wms.plugin.security.ModuleSecureURLParams</Class>
</Module>

```

Should I instead add something like this?

```auto
<Module>
<Name>ModuleSecureToken</Name>
<Description>ModuleSecureToken</Description>
<Class>com.wowza.wms.plugin.security.ModuleSecureToken</Class>
</Module>

```

---

<div class="post-metadata">

**Author:** ![Riki\_Babington1](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@Riki\_Babington1](https://community.wowza.com/u/Riki_Babington1)\
**Post date:** [April 7, 2009, 12:11pm UTC](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74/60 "2009-04-07T12:11:06Z")

</div>

Forgive me but Im still having problems. This seems so straightfoward and simple that I will just write down my steps and hopefully the error will reveal itself.

1. in RTMPModel.as I replaced the code in line 181

```auto
from:
TEA.decrypt(evt.info.secureToken,model.config['token']));

to:
TEA.decrypt(evt.info.secureToken,"#ed%h0#w@1"));

```

1. I installed the MediaSecurity package and created a new application called securestreaming and copied the default Application.xml into the new folder.

2. I added a new Property value like this:

```auto
<Property>
<Name>secureTokenSharedSecret</Name>
<Value>#ed%h0#w@1</Value>
</Property>

```

1. I then added a new Module like this:

```auto
<Module>
<Name>ModuleSecureToken</Name>
<Description>ModuleSecureToken</Description>
<Class>com.wowza.wms.plugin.security.ModuleSecureToken</Class>
</Module>

```

1. I then point the jw flashvar to streamer=rtmp://[wowzapro-ip-address]/securestreaming

2. Last I put the token #ed%h0#w@1 in the Player.as then re-publish

simplestreaming works fine for me, but the secure token doesnt. There is no error given, the video player just acts like its loading the video and never actually loads it. The loading circle just keeps spinning.

The error I get from the console is:

```auto
ERROR server comment - Error: SecureToken: Action before response received: kill connection

```

Thanks for the help

[Previous page](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74.md?page=2)

[Next page](https://community.wowza.com/t/adding-securetoken-protection-to-jw-player/74.md?page=4)