# SecureToken protection in Wowza Streaming Engine - HLS example

**URL:** <https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255>\
**Category:** Wowza Streaming Engine\
**Created:** [July 6, 2016, 3:16pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255 "2016-07-06T15:16:02Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Snezana\_Juric](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@Snezana\_Juric](https://community.wowza.com/u/Snezana_Juric)\
**Post date:** [July 6, 2016, 3:16pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/1 "2016-07-06T15:16:02Z")

</div>

Hi all,

We are trying to implement SecureToken protection in Wowza Streaming Engine.

The way we understood is that we should do something like this:

- sha256(“vod/sample.mp4?mySharedSecret&myTokenPrefixCustomParameter=abcdef&myTokenPrefixendtime=1467904640&myTokenPrefixstarttime=1467804640”)

- The result would be: b70c922b74dee5a94bb1f66e72dc5f6672e8924e9b9eebc38d9c068ae8944007

- Then, we do base64(b70c922b74dee5a94bb1f66e72dc5f6672e8924e9b9eebc38d9c068ae8944007)

- And we use the result of base64 as value for “myTokenPrefixhash” parameter.

---

<div class="post-metadata">

**Author:** ![Paul\_Shields](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/paul_shields/32/390_2.png) [@Paul\_Shields](https://community.wowza.com/u/Paul_Shields)\
**Post date:** [August 15, 2016, 12:09pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/2 "2016-08-15T12:09:08Z")

</div>

Hi,

Here’s an example of generating the hash using PHP which you are free to adapt for your own use

```auto
<?php

$clientIP = null; // provide client IP optionally
$host = "[WOWZA-HOST]"; // your ip/host
$url= "rtmp://".$host.":1935/";
$stream = "vod/_definst_/mp4:sample.mp4"; // your stream
$start = time();
$end = strtotime("+30 minutes");
$secret = "abcde";
$tokenName = "wowzatoken";
$hash = "";

if(is_null($clientIP))
{
	$hash = hash('sha384', $stream."?".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string

}
else
{
	$hash = hash('sha384', $stream."?".$clientIP."&".$secret."&{$tokenName}endtime=".$end."&{$tokenName}starttime=".$start, true); // generate the hash string
}

$base64Hash = strtr(base64_encode($hash), '+/', '-_');

$params = array("{$tokenName}starttime=".$start, "{$tokenName}endtime=".$end, "{$tokenName}hash=".$base64Hash);

if(!is_null($clientIP))
{
	$params[] = $clientIP;
}

sort($params);
$playbackURL = $url.$stream."/playlist.m3u8?";

if(preg_match("/(rtmp)/",$url))
{
	$playbackURL = $url.$stream."?";
}

foreach($params as $entry)
{
	$playbackURL.= $entry."&";
}

$playbackURL = preg_replace("/(\&)$/","", $playbackURL);

// echo "$playbackURL"; // DEBUG - show fully formed URL

?>

```

The above example is for sample.mp4 within the application “vod”. Secure Token must be enabled in that app for it to work, and you must set it up to reflect the script (or vice versa).

Regards,

Paul

---

<div class="post-metadata">

**Author:** ![permana\_anang](https://avatars.discourse-cdn.com/v4/letter/p/e0b2c6/32.png) [@permana\_anang](https://community.wowza.com/u/permana_anang)\
**Post date:** [August 30, 2017, 3:52am UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/3 "2017-08-30T03:52:17Z")

</div>

@Paul Shields

i am tray you scrit but in error.log wowza show

WARN server comment 2017-08-30 03:36:06 - - - - - 46.87 - - - - - - - - HTTPStreamerAdapterCupertinoStreamer.onPlaylist[vod/mp4:sample.mp4/playlist.m3u8?wowzatokenstarttime=1504064235&wowzatokenendtime=1504066035&wowzatokenCustomParameter=abcdef&wowzatokenhash=jHhM7Jh5\_zb1k6ry5SyKyZo3tkC0wS0GUjWx8UExMAocswho7FApMBUx-SIxkJEL]: Session not accepted[1829886621]

thank you

---

<div class="post-metadata">

**Author:** ![Paul\_Shields](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/paul_shields/32/390_2.png) [@Paul\_Shields](https://community.wowza.com/u/Paul_Shields)\
**Post date:** [August 30, 2017, 8:58am UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/4 "2017-08-30T08:58:21Z")

</div>

Hi,

Is this happening every time? It looks like session expiry so try with a new session or set the start and end times to 0 to see if that changes things. If the problem persists then I’d recommend opening a support ticket and include a link to the hosting page, a copy of your code, and a zip of your /conf and /logs [https://www.wowza.com/support/open-ticket](https://www.wowza.com/support/open-ticket)

It would also be useful to [enable Secure Token debug](https://www.wowza.com/docs/how-to-protect-streaming-using-securetoken-in-wowza-streaming-engine#logging_debug) briefly and run a few tests first to capture more detail in the logs.

Regards,

Paul

---

<div class="post-metadata">

**Author:** ![Dorota\_Szafer-Kwasik](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/dorota_szafer-kwasik/32/1150_2.png) [@Dorota\_Szafer-Kwasik](https://community.wowza.com/u/Dorota_Szafer-Kwasik)\
**Post date:** [February 22, 2018, 9:34pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/5 "2018-02-22T21:34:53Z")

</div>

Thanks for example. It works great. But such a question: I can not apply it to live DVR (HLS). What do I need to add? ups… thats easy… playlist.m3u8?DVR& - in this place:

1. $playbackURL = $url.$stream."/playlist.m3u8?";
2. Thanks, thanks for me 🙂 and You of course 🙂

---

<div class="post-metadata">

**Author:** ![Md\_Younus\_Hossen](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Md\_Younus\_Hossen](https://community.wowza.com/u/Md_Younus_Hossen)\
**Post date:** [April 17, 2018, 3:44pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/6 "2018-04-17T15:44:54Z")

</div>

I apply this but after 30 min from my site also stream get stop how I can sovle this?

---

<div class="post-metadata">

**Author:** ![Md\_Younus\_Hossen](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Md\_Younus\_Hossen](https://community.wowza.com/u/Md_Younus_Hossen)\
**Post date:** [April 19, 2018, 4:39pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/7 "2018-04-19T16:39:46Z")

</div>

I added my site but after 30 min from my web page stream also get stop how I can solve this?

---

<div class="post-metadata">

**Author:** ![Dorota\_Szafer-Kwasik](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/dorota_szafer-kwasik/32/1150_2.png) [@Dorota\_Szafer-Kwasik](https://community.wowza.com/u/Dorota_Szafer-Kwasik)\
**Post date:** [April 17, 2018, 5:01pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/8 "2018-04-17T17:01:25Z")

</div>

it easy…

1. $end = strtotime("+30 minutes");

change 30 to… what you wont

Regards

---

<div class="post-metadata">

**Author:** ![Md\_Younus\_Hossen](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@Md\_Younus\_Hossen](https://community.wowza.com/u/Md_Younus_Hossen)\
**Post date:** [April 17, 2018, 5:05pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/9 "2018-04-17T17:05:13Z")

</div>

If I change it works but my token link also works that time so 3rd party can play that time . I want token link will play short time but my web site will play long ( unlimited ) time, can I do this?

---

<div class="post-metadata">

**Author:** ![Andres\_Lopezvictori1](https://avatars.discourse-cdn.com/v4/letter/a/49beb7/32.png) [@Andres\_Lopezvictori1](https://community.wowza.com/u/Andres_Lopezvictori1)\
**Post date:** [April 26, 2018, 9:46pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/10 "2018-04-26T21:46:35Z")

</div>

any update? this works for me but, I want token link will play short time but my web site will play long ( unlimited ) time,

---

<div class="post-metadata">

**Author:** ![Divinder\_Singh](https://avatars.discourse-cdn.com/v4/letter/d/a5b964/32.png) [@Divinder\_Singh](https://community.wowza.com/u/Divinder_Singh)\
**Post date:** [April 28, 2018, 4:49am UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/11 "2018-04-28T04:49:59Z")

</div>

The example allows the link to work for 30 minutes. If you want to shorten the time, you can modify the script as Dorota Szafer-Kwasik explained above. You might also want to include the client’s IP address for maximum protection of your stream.

---

<div class="post-metadata">

**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\
**Post date:** [October 2, 2019, 5:28pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/12 "2019-10-02T17:28:39Z")

</div>

Tech support is asking: Do you have two different users @Rex Wowza?

---

<div class="post-metadata">

**Author:** ![Dorota\_Szafer-Kwasik](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/dorota_szafer-kwasik/32/1150_2.png) [@Dorota\_Szafer-Kwasik](https://community.wowza.com/u/Dorota_Szafer-Kwasik)\
**Post date:** [June 5, 2020, 1:44pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/13 "2020-06-05T13:44:52Z")

</div>

Hi.

I try to do - “include the client’s IP address for maximum protection of your stream” then … it doesn’t work. Do I do something wrong?

$ clientIP = $ \_SERVER [‘REMOTE\_ADDR’]; // provide client IP optionally

Can you explain to me? How to do it to add the client’s IP address?

Best Regards

D

---

<div class="post-metadata">

**Author:** ![Dorota\_Szafer-Kwasik](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/dorota_szafer-kwasik/32/1150_2.png) [@Dorota\_Szafer-Kwasik](https://community.wowza.com/u/Dorota_Szafer-Kwasik)\
**Post date:** [June 5, 2020, 1:42pm UTC](https://community.wowza.com/t/securetoken-protection-in-wowza-streaming-engine-hls-example/47255/14 "2020-06-05T13:42:23Z")

</div>

Hi.

I try to do - “include the client’s IP address for maximum protection of your stream” then … it doesn’t work. Do I do something wrong?

$ clientIP = $ \_SERVER [‘REMOTE\_ADDR’]; // provide client IP optionally

Can you explain to me? How to do it to add the client’s IP address?

Best Regards

D