# SWF Hotlinking Protection - JW Player 6
**URL:** https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848
**Category:** Wowza Streaming Engine
**Tags:** media-players-and-devices
**Created:** [July 31, 2013, 8:25am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848 "2013-07-31T08:25:02Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [July 31, 2013, 8:25am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/1 "2013-07-31T08:25:02Z")
Hello, I found this post about protecting the swf from hotlinking.
This might be what I need. I need to stop people form being able to just grab the source code and play my live stream from anywhere.
[https://www.wowza.com/docs/how-to-combat-hotlinking-your-adobe-flash-swf-file](https://www.wowza.com/docs/how-to-combat-hotlinking-your-adobe-flash-swf-file)
Does anyone know if this works with JW Player? Or does it only work with certain players?
Also, does it require a wowza premium add-on because I am using a trial right now for testing.
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [July 31, 2013, 8:57am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/2 "2013-07-31T08:57:48Z")
It must not work. The directions were pretty straight forward.
I added the .Jar file in the lib directory… then added the and to the correct place.
Restarted wowza server… but can still play the video through the jwplayer 6 from anywhere.
Any tips?
---
### Author:  [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)
#### Post date: [July 31, 2013, 6:04pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/3 "2013-07-31T18:04:18Z")
What this does is prevent hotlinking, where someone uses an absolute URL to your web server and player .swf file to display your player in their website.
For basic protection you need [SecureToken](https://www.wowza.com/docs/how-to-add-securetoken-protection-to-jw-player) and to use [RTMPE](https://www.wowza.com/docs/how-to-get-wowza-rtmpe-addon) or [RTMPS](https://www.wowza.com/docs/how-to-get-ssl-certificates-from-the-streamlock-service) protocols.
Richard
---
### Author:  [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)
#### Post date: [August 1, 2013, 1:38pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/4 "2013-08-01T13:38:42Z")
Roger’s outline shows what goes where (On the Web Server, 1, 2, 3). If you want to implement something like this but need help you can post in the [Find a Consultant forum](http://community.wowza.com/c/-/7), or write to support@wowza.com and ask for the list of independent consultants.
Otherwise, you can use the built-in security measures for pretty good security.
Richard
---
### Author:  [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)
#### Post date: [August 1, 2013, 3:00pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/5 "2013-08-01T15:00:16Z")
There is an example here:
[https://www.wowza.com/docs/how-to-use-the-imediastreamnamealiasprovider2-interface](https://www.wowza.com/docs/how-to-use-the-imediastreamnamealiasprovider2-interface)
And here is the [ServerSide API](https://www.wowza.com/resources/WowzaMediaServer_ServerSideAPI.pdf)
Richard
---
### Author:  [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)
#### Post date: [August 1, 2013, 4:50pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/6 "2013-08-01T16:50:31Z")
Yes, right, this is not built-in. The built-in security features are documented in [The Security Overview](https://www.wowza.com/docs/media-security-overview)
Richard
---
### Author:  [@Roger\_Littin1](https://community.wowza.com/u/Roger_Littin1)
#### Post date: [August 1, 2013, 10:08am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/7 "2013-08-01T10:08:16Z")
Hi,
The module checks the web page that the player is launched from and allows the connection if it matches the list. It will not prevent someone from iframing your player page or using a direct link to your swf file and passing the parameters in on the link.
To prevent this, you need regular hotlink protection enabled on your website. this is normally done with a .htaccess file in the folder on the web server that only allows listed referrers to access the files.
[This tool](http://www.htaccesstools.com/hotlink-protection/), will generate the required .htaccess file. You need to make sure you do not allow blank referrers and set it to block access to swf and possibly js file extensions. If blank referrers is allowed then someone will still be able to type your swf url directly into their browser.
Roger.
---
### Author:  [@Roger\_Littin1](https://community.wowza.com/u/Roger_Littin1)
#### Post date: [August 1, 2013, 12:27pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/8 "2013-08-01T12:27:43Z")
Hi,
Secure token will only allow a player with the correct token to connect to the Wowza Server. It will not stop someone from downloading your player and putting it on their own website.
Setting Connections/AutoAccept to false and Connections/AllowedDomains to your own domains in the Application.xml will prevent an swf from another domain from connecting to your server which will block someone who has downloaded your player or has compiled their own player with your token.
```auto
false
localhost,*yourswfdomain.com
```
ModuleHotlinkDenial will check the Web Page Referrer to see if it is allowed to connect to your server. It will not prevent someone from linking directly to your player swf file and passing the params in the link.
```auto
domainLock
localhost,*yourwebdomain.com
```
Web site Hotlink Protection will prevent someone from directly linking to the swf file.
None of the above will prevent someone from iframing your web page or player. The way to stop that is control access to the actual player and page. Require users to be logged in somehow but don’t make it automated.
All of these methods on their own can be bypassed fairly easily but combined make it difficult but not impossible for someone who is determined to bypass your security.
The best method would be to encrypt the stream name on your web server dynamically along with some other information that would be unique to the connection and would only be known by the web server and the Wowza server. When the request comes in, decrypt the stream name and check the information. If it passes, allow the stream to be played.
Example.
On the Web Server:
- Have the following information:
- Secret Value
- Users ip address
- Actual Stream Name
- Current Timestamp
- Any other values you want.
- Create an MD5 hash of these values.
- The Wowza server will know the secret and the ip address but it needs the stream name and timestamp and any extra values. The more information you use, the harder it will be to bypass but could also lead to playback problems for legitimate users.
- Base64 decode the requested name to get the separate values.
- Create an md5 hash of the locally known values and the extra values extracted from the requested name.
- If this local has value matches what is extracted from the requested name then you are fairly confident that the connection is legitimate.
---
### Author:  [@Roger\_Littin1](https://community.wowza.com/u/Roger_Littin1)
#### Post date: [August 3, 2013, 9:37am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/9 "2013-08-03T09:37:18Z")
Hi,
The base64 encode would just be the stream name part of the url. The rtmp address part would be standard. JW Player has no way of knowing it needs to decode the file parameter.
```auto
rtmp://wowzaIP:1935/live/[encoded-stream-name]
```
On the server, your custom module would decode the stream name.
Roger.
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [July 31, 2013, 10:13am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/10 "2013-07-31T10:13:34Z")
Right, but it still allows hotlinking. I can copy the page source along with the jwplayer folder and play it from anywhere.
On the wowza site it shows to be an add-on… maybe you have to pay for it to enable the feature… though the tutorial does not say that.
I read up on the token but I cant have users typing in a code each time they change to a new camera stream…
From the looks of it RTMPE does not stop people from being able to copy your source code and connect to it any time they want.
I am not sure where to go from here… Maybe I will see if they have a paid support line…
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [July 31, 2013, 2:21pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/11 "2013-07-31T14:21:22Z")
The method you are talking about won’t stop people from just copying the page source will it?
Or will it?
That is what I am trying to stop. People can just copy the html… download the jwplayer files… and watch the video from our cameras whenever they want…
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 5:16am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/12 "2013-08-01T05:16:35Z")
Thank you! This seems like a great option. So even if people copy the source code it wont matter because that link wont be active for long… 🙂
Question. Where how will the wowza server know the secret? Is there a certain place in the config that we are supposed to put the secret phrase, timestamp, etc.?
> The Wowza server will know the secret and the ip address but it needs the stream name and timestamp and any extra values.
One last question.
In this scenario where would this script with all the encrytping code go?
Would it go on my web server where the pages with the video embeded will be?
Would it be called when the page loads or something?
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 6:54am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/13 "2013-08-01T06:54:37Z")
Is there an sdk for wowza? Or any documentation about how to implement the IMediaStreamNameAliasProvider2-interface module?
I see how to add the in to the Application.xml file… but I cant find any documentation about editing the actual module.
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 8:17am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/14 "2013-08-01T08:17:17Z")
Is this correct?
To use this method I need to install the wowza IDE and create a module from scratch that implements the IMediaStreamNameAliasProvider(2) interface. ?
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 8:54am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/15 "2013-08-01T08:54:34Z")
wow ok thanks. yeah i had no idea what was involved… i just got a link to a document that showed that you have to install eclipse and the ide etc.
i was thinking i would just paste the info into a conf file on the wowza server… 🙂
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 2:30pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/16 "2013-08-01T14:30:26Z")
When I put the base64 encoded url into jw player 6 it gives an error and won’t play…
This is what it looks like in the player:
That is the base url of my rtmp url:
file: “rtmp://wowzaIP:1935/live/camera.stream”
Is that what you meant by putting the base64 path into the player?
Thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 1, 2013, 4:07pm UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/17 "2013-08-01T16:07:44Z")
OK, I see… so you have to have the module in place first.
The module is what decodes it from base64 so wowza can understand it…
Is that about what it should look like in the player though?
Just the base64 string in there like that?
thanks
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 7, 2013, 6:59am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/18 "2013-08-07T06:59:40Z")
OK, I got the IDE installed… and got a custom application / module running with no errors.
Now I just need to code that module to decode the base64 stream name.
Question.
Do I need to use the IMediaStreamNameAliasProvider2 module found here: ?
[https://www.wowza.com/docs/how-to-use-the-imediastreamnamealiasprovider2-interface](https://www.wowza.com/docs/how-to-use-the-imediastreamnamealiasprovider2-interface)
Or can I just start with a new empty module and write the java code to decode the stream name?
I am not sure if I need creating an IMediaStreamNameAliasProvider2 module…
Or just creating a new module that does the decoding…
Hope that makes sense.
Thanks for your time
---
### Author:  [@Kenny\_Johnson](https://community.wowza.com/u/Kenny_Johnson)
#### Post date: [August 7, 2013, 8:55am UTC](https://community.wowza.com/t/swf-hotlinking-protection-jw-player-6/40848/19 "2013-08-07T08:55:16Z")
I just thought about something…
If I put the encoded “secret phrase” into the code of the web page… wont users just be able to copy it and decode it?
Then once they have the decoded stream name and “secret phrase” they can still connect…
Or am I missing part of the equation?
Thanks