# Playback security **URL:** \ **Category:** Wowza Streaming Engine\ **Tags:** security\ **Created:** [October 13, 2018, 4:52pm UTC](https://community.wowza.com/t/playback-security/52128 "2018-10-13T16:52:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Keerthivasan\_Subrama](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Keerthivasan\_Subrama](https://community.wowza.com/u/Keerthivasan_Subrama)\ **Post date:** [October 13, 2018, 4:52pm UTC](https://community.wowza.com/t/playback-security/52128/1 "2018-10-13T16:52:09Z")
We are trying to enable Playback security on our installation of Wowza. We are unable to get it working. Any help would be appreciated. We are live streaming and using adaptive bit rate to send out streams. We are using the HLS stream. We are sending it via HTTPS to CloudFront. The CloudFront URL is invoked in Flow player on our site. We are hashing in Java The live stream works without the security. The parameters we are using for hashing are as follows: Content URL: https:///vikashTest/ngrp:myStream\_all/playlist.m3u8 Content path: vikashTest/ngrp:myStream\_all Custom SecureToken prefix: wowzatoken Token start time: wowzatokenstarttime=0 Token end time: wowzatokenendtime=0 Shared secret: mySharedSecret (we are using the default for our prototyping) ----Hashing Code---------- hash algorithm private static String getSHA\_256\_SecurePassword(String passwordToHash) { String generatedHash = null; try { MessageDigest md = MessageDigest.getInstance(“SHA-256”); byte[] bytes = md.digest(passwordToHash.getBytes()); generatedHash= Base64.getUrlEncoder().encodeToString(bytes); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } return generatedHash; } //for hash input string String inputurl=“myApp/”+ streamingName.getStreamName() + “\_all”+"?"+mySharedSecret+"&wowzatokenendtime=0&wowzatokenstarttime=0"; String wowzatokenhash=getSHA\_256\_SecurePassword(hashfinal); //main url- String applicationName = streamingName.getWowzaApplicationName() + “/ngrp:” + streamingName.getStreamName() + “\_all/playlist.m3u8?wowzatokenendtime=0&wowzatokenstarttime=0&wowzatokenhash=”+wowzatokenhash; ----Hashing Code---------- Are the hashing parameters expected in a certain order? What are we missing? ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [October 14, 2018, 5:46pm UTC](https://community.wowza.com/t/playback-security/52128/2 "2018-10-14T17:46:07Z")
Hello @Keerthivasan Subramaniam, we would need to run some tests on your files. Can you kindly submit a support ticket? [https://www.wowza.com/support/open-ticket](https://www.wowza.com/support/open-ticket) ---
**Author:** ![Keerthivasan\_Subrama](https://avatars.discourse-cdn.com/v4/letter/k/9f8e36/32.png) [@Keerthivasan\_Subrama](https://community.wowza.com/u/Keerthivasan_Subrama)\ **Post date:** [October 15, 2018, 3:46pm UTC](https://community.wowza.com/t/playback-security/52128/3 "2018-10-15T15:46:21Z")
@Rose, Thanks for the response. We have been able to implement Playback security for the un-grouped stream. However, we have not been able to get it to work for the grouped stream, i.e. ngrp:myStream\_all. What do we need to do to hash the grouped stream? ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [October 15, 2018, 5:45pm UTC](https://community.wowza.com/t/playback-security/52128/4 "2018-10-15T17:45:10Z")
Here is the walkthrough for this process @Keerthivasan Subramaniam: [https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine](https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine) ---
**Author:** ![Phuong\_Binh\_To\_Duong](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@Phuong\_Binh\_To\_Duong](https://community.wowza.com/u/Phuong_Binh_To_Duong)\ **Post date:** [January 4, 2019, 8:43am UTC](https://community.wowza.com/t/playback-security/52128/5 "2019-01-04T08:43:36Z")
I using that vs hash url, but still download by other tools, can help me? I see in m3u8 show all path or videos ( 1.ts, 2.ts…) and no codec attributes. Thank you. ---
**Author:** ![Rex\_Wowza](https://avatars.discourse-cdn.com/v4/letter/r/dc4da7/32.png) [@Rex\_Wowza](https://community.wowza.com/u/Rex_Wowza)\ **Post date:** [October 2, 2019, 8:17am UTC](https://community.wowza.com/t/playback-security/52128/6 "2019-10-02T08:17:30Z")
2 diffent hash WHY ? IP DIFFENT ModuleCoreSecurity:string hashed: vod18/vod/mp4:10810/1003/HOMA-068-C/HOMA-068-C.mp4?223.137.10.196&63e9367298459771&wowzatokenendtime=1570009821&wowzatokenstarttime=1570002621 ModuleCoreSecurity:string hashed: vod18/vod/mp4:10810/1003/HOMA-068-C/HOMA-068-C.mp4?63e9367298459771&8.39.127.102&wowzatokenendtime=1570005587&wowzatokenstarttime=1569998387 ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [October 2, 2019, 7:34pm UTC](https://community.wowza.com/t/playback-security/52128/7 "2019-10-02T19:34:10Z")
Tech support is wondering if you could have two different users here @Rex Wowza? ---
**Author:** ![Rex\_Wowza](https://avatars.discourse-cdn.com/v4/letter/r/dc4da7/32.png) [@Rex\_Wowza](https://community.wowza.com/u/Rex_Wowza)\ **Post date:** [October 3, 2019, 4:24am UTC](https://community.wowza.com/t/playback-security/52128/8 "2019-10-03T04:24:31Z")
```auto Same device, just enable VPN to change different IP ```