# What's the point of token authentication if user and share m3u8 and play via VLC without any problem? **URL:** \ **Category:** Wowza Video (Formerly Streaming Cloud)\ **Created:** [December 3, 2020, 12:59pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446 "2020-12-03T12:59:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Rattanon\_Chuaphet](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@Rattanon\_Chuaphet](https://community.wowza.com/u/Rattanon_Chuaphet)\ **Post date:** [December 3, 2020, 12:59pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/1 "2020-12-03T12:59:47Z")
I really don’t understand. I created signed url by using token authentication from this tutorial [https://www.wowza.com/docs/how-to-protect-a-wowza-cdn-stream-target-with-token-authorization-in-wowza-streaming-cloud](https://www.wowza.com/docs/how-to-protect-a-wowza-cdn-stream-target-with-token-authorization-in-wowza-streaming-cloud) But guess what my viewer still can copy m3u8 and share to anyone and paste it in open network menu in VLC and can watch it super smoothly without any protection. Wowza Cloud should have feature that can protect playlist with domain referrer just like engine. ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [December 3, 2020, 7:22pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/2 "2020-12-03T19:22:33Z")
I responded in your other post asking the same question. But, I’m adding a suggestion in both. ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [December 3, 2020, 9:16pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/3 "2020-12-03T21:16:05Z")
What you can try per the engineers is try the Access control property in WSC. -it forces the stream to only work from a defined domain. So people would not be allowed to play it anywhere you don’t say it can be played. ---
**Author:** ![Rattanon\_Chuaphet](https://avatars.discourse-cdn.com/v4/letter/r/bc8723/32.png) [@Rattanon\_Chuaphet](https://community.wowza.com/u/Rattanon_Chuaphet)\ **Post date:** [December 4, 2020, 2:31am UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/4 "2020-12-04T02:31:08Z")
May I know how can I access ‘Access control preperty’ in Wowza Streaming Cloud? Thank you for your answer. ---
**Author:** ![BOOKSHOW\_TW](https://avatars.discourse-cdn.com/v4/letter/b/839c29/32.png) [@BOOKSHOW\_TW](https://community.wowza.com/u/BOOKSHOW_TW)\ **Post date:** [August 24, 2021, 12:40pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/5 "2021-08-24T12:40:58Z")
I use “Stream Targets / Properties / HLS / Access Control: Allow Origin” to allow embedding into specific domain by browser. But it doesn’t affect VLC player… ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [August 24, 2021, 3:59pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/6 "2021-08-24T15:59:45Z")
This original post is on Streaming Cloud. Are you referring to Streaming Engine @BOOKSHOW_TW? If you are: Can you check the application.xml file to make sure it was added properly? ``` cupertinoUserHTTPHeaders Access-Control-Allow-Origin: * ``` ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [August 24, 2021, 4:06pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/7 "2021-08-24T16:06:44Z")
If you are using Cloud @BOOKSHOW_TW did you try it with a different player to see if it’s a VLC issue we need to look at? ![Screen Shot 2021-08-24 at 10.04.25 AM](https://us1.discourse-cdn.com/flex002/uploads/wowza1/original/1X/1c5235df7dcc57f256eee22800d6905e232db8dd.png) You are using Fastly which is the default in Cloud and you didn’t change it to Akamai? ---
**Author:** ![Rose\_Power-Wowza\_Com](https://sea2.discourse-cdn.com/flex002/user_avatar/community.wowza.com/rose_power-wowza_com/32/431_2.png) [@Rose\_Power-Wowza\_Com](https://community.wowza.com/u/Rose_Power-Wowza_Com)\ **Post date:** [August 24, 2021, 4:13pm UTC](https://community.wowza.com/t/whats-the-point-of-token-authentication-if-user-and-share-m3u8-and-play-via-vlc-without-any-problem/92446/8 "2021-08-24T16:13:24Z")
Can you try it in this test player and see if it’s a configuration error or something with the VLC player version you are on? Sometime the player has to have this in the settings @BOOKSHOW_TW for the “Allow origin” to work. `withCredentials: true` You can try a Demo player from JWPlayer here: [https://developer.jwplayer.com/tools/stream-tester/](https://developer.jwplayer.com/tools/stream-tester/) We most likely need to debug this in a support ticket for accurate diagnosis. You can run this in VLC player using Fastly in Cloud, so we’ll need to take a closer look.