Efficient tools to build your streaming infrastructure

Hotlink protection

Available for Nimble Streamer and Wowza Streaming Engine

Hot-linking (or hotlinking) is a process of re-streaming of the streaming media. This is critical for any business which has premium access to their assets. It you have any exclusive content, you're loosing money in case of hot-linking.

What can we do?

We provide a token-based authorization to check each incoming connection signature against original published signature.
The following Nimble Streamer entities can be protected: entire server, application and stream.
The following Wowza entities can be protected: entire server, virtual host, application, application instance and stream.
All protocols supported by respective media servers are covered by hotlink protection.

The protection consists of 3 parts - server support (built into Nimble Streamer and available in Wowza agent), a code snippet on a web page which generates a signature for the stream URL and a control interface to enable the protection.

Hotlink protection is integrated in two steps. They are:

  1. Modify media player web page to have a signature of media URL.
  2. Set up and enable protection via web control panel.

1. Make media URL signature

To sign media URL for further recognition and handling, the web page with media player must be slightly modified.

1.1 Signature code

As example, you have these URLs for your live stream:
The modified URLs would be:

To generate signature you need to modify your front-end source to include code snippet.

Click here to see the PHP source code to generate this signature.

In this sample key means the password which will be used later for setting up rule in control panel and validminutes means number of minutes while this signed link will be valid to let people read the page and start the playback.

1.2 More examples

You can find more code samples for various programming languages in Paywall samples github repository and adapt them for your use case.

2. Set up control panel settings

After the code is set on web server side, Nimble Streamer (or Wowza agent) must be notified about protection settings.
Go to top menu and select "Control" -> "WMSAuth paywall setup".

WMSAuth is a feature set which handles hotlink protection and other features like geo-lock and pay-per-view.

2.1 WMSAuth group

In WMSAuth, every restriction may be applied to a group of servers. So the first thing to do is to create a group and assign one or more servers to it.
Click on Add WMSAuth group to specify its name and proceed to further setup.

WMSAuth setup groups

2.2 WMSAuth rule

Within a group, there may be several rules, each working with its set of Nimble Streamer or Wowza entities. Just click on "Add rule" to enter rule creation page.
Check this screenshot to see how you can specify application or stream regular expression.

WMSAuth setup rule

The last thing to specify is a key, or password, which was inserted into the media signature on web server side in section "Make media signature" above.
After you save the rule, it will be applied to the server within a few seconds.

WMSAuth setup password

Time tolerance parameter means maximum time range that is allowed for web server and media server to be unsynchronized. It should be used when you can't arrange these times to match perfectly.

Is that all I need?

Yes. Now when your media is signed with WMSAuth signature, Nimble Streamer or Wowza will be checking each incoming request against its media signature. Immediately after that the connection will be either allowed or denied, it takes just several milliseconds.

The hot-linking protection functionality is also working with stream-based signature for Nimble Streamer.

You may also combine this functionality with geo-location and IP ranges restriction as well as connections and bandwidth limitation. This is also a foundation for pay-per-view feature set.

Questions or problems

Hotlink protection does not work? Check the troubleshooting FAQ.

What if WMSPanel is not accessible? Hot-linking protection works regardless of WMSPanel availability. If your server can't connect to WMSPanel for some reason, the protection will still work perfectly. Once the rules are set up, the control panel is not used anymore.