FLV Hotlink Protection - GoFuckYourself.com

pornask · 03-23-2009, 08:38 AM

What's the best solution to prevent other sites from hotlinking my .flv video? I have some websites from Turkey and China embedding their flv players, but hotlinking my videos on their websites. Are there any good scripts to take care of this? Or alternatively, could this be safely taken care of with .htaccess by any chance?

fris · 03-23-2009, 08:41 AM

only allow linking from your domain only

pornask · 03-23-2009, 08:42 AM

how do I do that? I know how to do image files, but not sure how to take care of .flvs

Sands · 03-23-2009, 08:48 AM

My recent research has led me to the conclusion that hotlink protection for Flash video files is quite difficult as Flash video players do not send referrer information when they access the video. If I'm not mistaken, .htaccess depends on this referring information to determine whether or not the video is being hotlinked.

Your best option, given the above information is accurate, is to seek out and implement some streaming video solution as they normally afford you hotlinking protection.

Outside of this, you will probably want to obfuscate the link to your videos (such as using www.domain.com/stream.php?video_id=X as the URL for the video) and/or implement some solution where the names of your video files are changed at certain invervals.

Hopefully someone more knowledgeable than myself will chime in.

nation-x · 03-23-2009, 08:48 AM

Use wowza

Zorgman · 03-23-2009, 08:49 AM

Dump for the htaccess answer.

TheSenator · 03-23-2009, 08:57 AM

It is difficult....I change the name of my files periodically.

pornask · 03-23-2009, 09:00 AM

Quote:

Originally Posted by TheSenator

It is difficult....I change the name of my files periodically.

That's what I resorted to now that I've seen how much fucking bandwith they'd wasted. Especially the Chinese fuckers

I'm still hoping there's a script that works well enough for this

Phil21 · 03-23-2009, 09:02 AM

There are many modules for Apache, lighttpd, etc. that do this for you.

.htaccess (mod_rewrite used for referrer blocking) is not an option for blocking FLV's, or really any video whatsoever.

It depends on your server setup and configuration which modules can be used, and how hard said modules are to implement.

The most basic and easiest way is if the videos are only to be accessed from your domain(s), and you can make a rule such as "unless the visitor has visited page X in the last 15 minutes, deny all video loads for them".

From there, you can do more complicated things such as have your application link to videos with a secure token in the URL, etc. This would require some form of application modifications however. More and more apps are starting support this.

If you also need to support embeds in random websites, it gets a lot harder to "filter" good traffic from bad. You can setup mod_geoip to do most of what you like most likely, but we have run into some customers who want quite a bit of complex rulesets made - so sometimes it can be difficult.

fris · 03-23-2009, 12:29 PM

i tried this via htaccess

direct link http://www.domain.com/video.flv (blocks it)
wget link (blocks it)
embed from a player on another server (blocks it)
download manager (blocks it)

Code:

Options +FollowSymLinks
RewriteEngine On
RewriteCond {HTTP_REFERER} !^(http://(www\.)?domain\.com(/.*)?)?$ [NC]
RewriteRule \.(flv|mpg|wmv)$ - [NC,F,L]

k0nr4d · 03-23-2009, 01:41 PM

mod_secdownload...

Antonio · 03-23-2009, 01:55 PM

Quote:

Originally Posted by pornask

That's what I resorted to now that I've seen how much fucking bandwith they'd wasted. Especially the Chinese fuckers

I'm still hoping there's a script that works well enough for this

all flvs in one folder and change the folder name periodically rahter than each file's name, better yet if your script can do this

pornask · 03-23-2009, 05:27 PM

Quote:

Originally Posted by fris

i tried this via htaccess

direct link http://www.domain.com/video.flv (blocks it)
wget link (blocks it)
embed from a player on another server (blocks it)
download manager (blocks it)

Code:

Options +FollowSymLinks
RewriteEngine On
RewriteCond {HTTP_REFERER} !^(http://(www\.)?domain\.com(/.*)?)?$ [NC]
RewriteRule \.(flv|mpg|wmv)$ - [NC,F,L]

I'm gonna give this a try. Being a complete newb, I take it "domain" is to be replaced with my domain name (the only domain name that will be allowed to play these files) and trailing slashes retained as in example, right? i also take it this .htaccess file is to be uploaded in the directory where files are stored, right?

pornask · 03-23-2009, 09:00 PM

Fris, I've tested some of the things and it seems to work fine on those. Will do some more testing, just had quick question - what line would I need to add to it in order to allow one more external domain name to play back the videos (in other words, both local plus one more domain name would be allowed to play it back).

darksoul · 03-24-2009, 02:23 AM

Quote:

Originally Posted by fris

i tried this via htaccess

direct link http://www.domain.com/video.flv (blocks it)
wget link (blocks it)
embed from a player on another server (blocks it)
download manager (blocks it)

Code:

Options +FollowSymLinks
RewriteEngine On
RewriteCond {HTTP_REFERER} !^(http://(www\.)?domain\.com(/.*)?)?$ [NC]
RewriteRule \.(flv|mpg|wmv)$ - [NC,F,L]

Thats because your ruleset denies all requests without an HTTP_REFERER,
you are going to block a lot of legit requests with that.

PowerCum · 03-24-2009, 03:27 AM

There are several ways to do it.

Of course, since I also run tube sites I am not interested in telling you how and make you a viable competition.

Hire a coder/server admin or research it by yourself.

wizzart · 03-24-2009, 03:37 AM

what script you use, that don't have hotlink protection?

fris · 03-24-2009, 04:27 AM

Quote:

Originally Posted by darksoul

Thats because your ruleset denies all requests without an HTTP_REFERER,
you are going to block a lot of legit requests with that.

doesnt this only permit domain.com to show the videos or else it blocks it?

if not domain.com as refer then 403?

i only want to display it on domain.com

just a punk · 03-24-2009, 04:50 AM

There is no way to protect FLV files on 100%. Every method (including cookies, obfuscated names etc) can be easily hacked if someone needs it.

just a punk · 03-24-2009, 04:58 AM

So if you are a tube owner - get ready to be ripped off.

darksoul · 03-24-2009, 05:02 AM

Quote:

Originally Posted by fris

doesnt this only permit domain.com to show the videos or else it blocks it?

if not domain.com as refer then 403?

i only want to display it on domain.com

You are right about that.
The problem with flv players is that they don't send a HTTP_REFERER (just like the old movie problem) and you will be blocking legitimate requests.
This is the reason scripts like antihotlinking, traffic guardian and the like were created.

NemesisEnforcer · 03-24-2009, 05:33 AM

Quote:

Originally Posted by pornask

That's what I resorted to now that I've seen how much fucking bandwith they'd wasted. Especially the Chinese fuckers

I'm still hoping there's a script that works well enough for this

I don't know how much bandwidth is costing you but check out LinkSentinel or contact them about your needs. They do custom work as well.

nation-x · 03-24-2009, 07:39 AM

http://www.axscripts.com/mod_antihotlink/

quantum-x · 03-24-2009, 07:55 AM

Quote:

Originally Posted by Sands

My recent research has led me to the conclusion that hotlink protection for Flash video files is quite difficult as Flash video players do not send referrer information when they access the video. If I'm not mistaken, .htaccess depends on this referring information to determine whether or not the video is being hotlinked.

Your best option, given the above information is accurate, is to seek out and implement some streaming video solution as they normally afford you hotlinking protection.

Outside of this, you will probably want to obfuscate the link to your videos (such as using www.domain.com/stream.php?video_id=X as the URL for the video) and/or implement some solution where the names of your video files are changed at certain invervals.

Hopefully someone more knowledgeable than myself will chime in.

Flash ALWAYS sends player/verion information along with it, including referer header information [at least, the last time I checked]. It's not possible to remove this from within the flash itself, the headers are fixed.

You don't want to change your filenames, what you want to do is this.
When you embed your videos, feed a hash into the player.
This hash will be either a] time locked, or b] 1 time only [ie, stored in a db]
The player, when it goes to load the video, will send the original hash, and modified [xoring is easiest] version of the hash.

When the request comes to play the file, if the first hash and second hash aren't present or aren't matching as they should be, the file simply doesn't play.

There are other steps to take from here, keeping your hash system well salted, encrypting your SWF file [to prevent your xor algo getting cracked]

This is not the only way. There are quite a few others, such as:
1 - Set a session when the visitor hits your page. No session, no play.
2- Whitelist the person's IP when they hit your page, for ~30 seconds to play a video.
No whitelist, no play.

There are heaps of ways of doing this

quantum-x · 03-24-2009, 07:58 AM

Quote:

Originally Posted by cyberxxx

There is no way to protect FLV files on 100%. Every method (including cookies, obfuscated names etc) can be easily hacked if someone needs it.

Well, as a general rule, if you can play it, you can steal it, but there are good ways to prevent hotlinking.

darksoul · 03-24-2009, 08:06 AM

Quote:

Originally Posted by quantum-x

Flash ALWAYS sends player/verion information along with it, including referer header information [at least, the last time I checked]. It's not possible to remove this from within the flash itself, the headers are fixed.

I had to double check to make sure, I'm not seeing it:

Code:

127.0.0.1 - - [24/Mar/2009:09:52:36 -0500] "GET /flvideo/1.flv HTTP/1.0" 200 4765368 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.7) Gecko/2009030422 Ubuntu/8.04 (hardy) Firefox/3.0.7"

Quote:

1 - Set a session when the visitor hits your page. No session, no play.
2- Whitelist the person's IP when they hit your page, for ~30 seconds to play a video.
No whitelist, no play.

Yeah, this is pretty much the best idea* as long as by session you're not referring to a browser session.

* - it can be tricked with frames so you will need to break out of frames
and with image preloading, you can use the standard mod rewrite protection for this.

quantum-x · 03-24-2009, 08:32 AM

Quote:

Originally Posted by darksoul

I had to double check to make sure, I'm not seeing it:

Code:

127.0.0.1 - - [24/Mar/2009:09:52:36 -0500] "GET /flvideo/1.flv HTTP/1.0" 200 4765368 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.7) Gecko/2009030422 Ubuntu/8.04 (hardy) Firefox/3.0.7"

That's a browser request.
Check the headers. Just cap'd this.

Code:

GET /video.php?file=SNIPSNIP HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: http://members3.site.com/flash/flvplayer.swf
x-flash-version: 10,0,12,36
UA-CPU: x86

You *cannot* unset x-flash-version, UA-CPU or Referer in flash.

I personally like the rolling hash + timebombed URLs. If you make them last for say 5 plays or 1 hour, people add them to their tubes and forget about them, then they end up w/ broken URLs ;)

pornask · 03-24-2009, 04:03 PM

Quote:

Originally Posted by PowerCum

There are several ways to do it.

Of course, since I also run tube sites I am not interested in telling you how and make you a viable competition.

Hire a coder/server admin or research it by yourself.

I'm not a tube owner. I own a blog and have three videos on it that I'm hosting myself. I don't pose a "competition" threat to anyone here. I'm focusing more and more on mainstream and blog in question is NOT an adult blog either. However I prefer to host my content myself, including pictures and videos so I don't have broken shit on my pages if owner of the video deletes it (even if we're talking youtube or liveleak). That's why I'm hosting my own videos. But fuck - I get a lot of bandwidth wasted by Chinese and Turkish fuckers and get nothing out of it in return, that's why I've asked if there was a way to eliminate this BW theft.

pornask · 03-24-2009, 04:05 PM

Quote:

Originally Posted by cyberxxx

So if you are a tube owner - get ready to be ripped off.

Not a tube owner, just an innocent blog with a couple of posts that contain videos is all. I have never owned a tube and don't plan on. However even if one of your videos gets hotlinked by a busy Chinese site, it eats up a lot of BW. I'm looking around for a solution to help me eliminate it.

03-23-2009, 08:38 AM	#1
pornask So Fucking Banned Join Date: Aug 2006 Location: 253-233-241 Posts: 6,518	FLV Hotlink Protection What's the best solution to prevent other sites from hotlinking my .flv video? I have some websites from Turkey and China embedding their flv players, but hotlinking my videos on their websites. Are there any good scripts to take care of this? Or alternatively, could this be safely taken care of with .htaccess by any chance?

03-23-2009, 08:41 AM	#2
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,212	only allow linking from your domain only __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

03-23-2009, 08:49 AM	#6
Zorgman Confirmed User Join Date: Aug 2002 Location: Sydney, Australia Posts: 6,103	Dump for the htaccess answer. __________________ ---

03-23-2009, 08:57 AM	#7
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,331	It is difficult....I change the name of my files periodically. __________________ ISeekGirls.com since 2005

03-23-2009, 09:02 AM	#9
Phil21 Confirmed User Join Date: May 2001 Location: ICQ: 25285313 Posts: 993	There are many modules for Apache, lighttpd, etc. that do this for you. .htaccess (mod_rewrite used for referrer blocking) is not an option for blocking FLV's, or really any video whatsoever. It depends on your server setup and configuration which modules can be used, and how hard said modules are to implement. The most basic and easiest way is if the videos are only to be accessed from your domain(s), and you can make a rule such as "unless the visitor has visited page X in the last 15 minutes, deny all video loads for them". From there, you can do more complicated things such as have your application link to videos with a secure token in the URL, etc. This would require some form of application modifications however. More and more apps are starting support this. If you also need to support embeds in random websites, it gets a lot harder to "filter" good traffic from bad. You can setup mod_geoip to do most of what you like most likely, but we have run into some customers who want quite a bit of complex rulesets made - so sometimes it can be difficult. __________________ Quality affordable hosting.

03-23-2009, 08:42 AM	#3
pornask So Fucking Banned Join Date: Aug 2006 Location: 253-233-241 Posts: 6,518	how do I do that? I know how to do image files, but not sure how to take care of .flvs

03-23-2009, 08:48 AM	#4
Sands Confirmed User Join Date: Feb 2007 Location: 418194907 Posts: 3,134	My recent research has led me to the conclusion that hotlink protection for Flash video files is quite difficult as Flash video players do not send referrer information when they access the video. If I'm not mistaken, .htaccess depends on this referring information to determine whether or not the video is being hotlinked. Your best option, given the above information is accurate, is to seek out and implement some streaming video solution as they normally afford you hotlinking protection. Outside of this, you will probably want to obfuscate the link to your videos (such as using www.domain.com/stream.php?video_id=X as the URL for the video) and/or implement some solution where the names of your video files are changed at certain invervals. Hopefully someone more knowledgeable than myself will chime in.

03-23-2009, 08:48 AM	#5
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	Use wowza

03-23-2009, 12:29 PM	#10
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,212	i tried this via htaccess direct link http://www.domain.com/video.flv (blocks it) wget link (blocks it) embed from a player on another server (blocks it) download manager (blocks it) Code: Options +FollowSymLinks RewriteEngine On RewriteCond {HTTP_REFERER} !^(http://(www\.)?domain\.com(/.*)?)?$ [NC] RewriteRule \.(flv\|mpg\|wmv)$ - [NC,F,L] __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

03-23-2009, 01:41 PM	#11
k0nr4d Confirmed User Industry Role: Join Date: Aug 2006 Location: Poland Posts: 9,228	mod_secdownload... __________________ Mechanical Bunny Media Mechbunny Tube Script \| Mechbunny Webcam Aggregator Script \| Custom Web Development

03-23-2009, 09:00 PM	#14
pornask So Fucking Banned Join Date: Aug 2006 Location: 253-233-241 Posts: 6,518	Fris, I've tested some of the things and it seems to work fine on those. Will do some more testing, just had quick question - what line would I need to add to it in order to allow one more external domain name to play back the videos (in other words, both local plus one more domain name would be allowed to play it back).

03-24-2009, 03:27 AM	#16
PowerCum CjOverkill Industry Role: Join Date: Apr 2003 Location: Woldwide Posts: 1,328	There are several ways to do it. Of course, since I also run tube sites I am not interested in telling you how and make you a viable competition. Hire a coder/server admin or research it by yourself. __________________ CjOverkill Traffic Trading Script Free, secure and fast traffic trading script. Get your copy now

03-24-2009, 03:37 AM	#17
wizzart scriptmaster Industry Role: Join Date: May 2006 Location: Serbia Posts: 5,237	what script you use, that don't have hotlink protection?

03-24-2009, 04:50 AM	#19
just a punk So fuckin' bored Industry Role: Join Date: Jun 2003 Posts: 32,381	There is no way to protect FLV files on 100%. Every method (including cookies, obfuscated names etc) can be easily hacked if someone needs it. __________________ Obey the Cowgod

03-24-2009, 04:58 AM	#20
just a punk So fuckin' bored Industry Role: Join Date: Jun 2003 Posts: 32,381	So if you are a tube owner - get ready to be ripped off. __________________ Obey the Cowgod

03-24-2009, 07:39 AM	#23
nation-x Confirmed User Industry Role: Join Date: Mar 2004 Location: Rock Hill, SC Posts: 5,370	http://www.axscripts.com/mod_antihotlink/