How to password lock the content, but also allow embeddings?

[homegrownhrbs]

Hi There,

I have a goofy usecase here.

I run an online school program and use MediaCMS to host and serve our video lectures. We primarily serve the videos as Iframe Embeds on the WordPress site that requires an account membership to access.

I do see that MediaCMS has a config option to require user login to access the videos, GLOBAL_LOGIN_REQUIRED = True in the deploy/docker/local_settings.py file.

This is great, but it also forces the rule on embeds.

Is there a variable that exists (or could be added) that would allow the embeds of the media files to not be password protected, like 'GLOBAL_LOGIN_EMBED_BYPASS = True'

Or even better a domain whitelist that would disable the login requirement for embed on whitelisted domains?

Please and thank you!

[Bewinxed]

Also looking for this.

[yatesdr]

I have a demo with a working solution for this, described in issue #1090

The requirements are:

1. Global login must be enabled
2. You must have the video as "unlisted" or "public" - I have not tried with "private" videos, and it will likely not work as it requires a specific user auth. However, unlisted should be okay with the GLOBAL_LOGIN_REQUIRED flag enabled as they will not be browsable or viewable except from the white-listed referer's site.
3. The upstream referer must set the HTTP_REFERER header which includes the referring domain. Note that this header can be spoofed fairly trivially, so it's not a perfect solution, but it will knock down most casual attempts to extract media.

The current limitations for my use are:

1. The video player needs to be patched to avoid "next", "more", "other videos" that tend to come up at the end of the video. I'm working on a "clean embed" patch for that, but in the mean time it's easy enough to patch the CSS in your system's _common.css file to hide these elements.

I'm evaluating it in Canvas (an online learning platform) to allow for embedded videos in the courses without making all the videos publicly accessible to any viewer. It's not perfect security, but it's reasonable for the use-case in my opinion. I think the utility of MediaCMS is very suitable for this use case, and works around the normal Kaltura issues in a pretty useful way for self-hosted videos.

After some more review, I am hopeful to be able to refine it according to the issue open points and release a PR.