Authenticating URLs in iframe src and script src

Question

In our app, we allow people to embed videos using iframe or script tags. But we dont want to allow the people watching the video to easily copy these embed codes and post them elsewhere.

For iframes - what we've done is, in the iframe tag, we replace the src attribute's value with a proxy URL we have setup inside our application which simply redirects to the actual src URL. Besides this, it also does the authentication at this stage.

Clever people will surely be able to crack this, but this seems like a good solution for most cases since when they try to inspect the dom they only see the proxy URL and not the actual one.

For < script/> - I tried doing the same, but did not work out. Eg. -

<div id="wowza_player"><script src='//player.cloud.wowza.com/hosted/abcdefg/wowza.js' type='text/javascript'></script></div>

Is there anyway to obfuscate or prevent abuse of these embed codes?

Thanks!

Can you give an example of what the script embed would look like? — Niki van Stein, Dec 10 '15 at 15:33
With iframes the way you are doing is a good way to achieve that. With Scripts i think it is difficult to do it since it has to run on browser client. The only way i can think of right now is to minify it so that its not easily readable. — Sachin, Dec 10 '15 at 15:33
You could use a proxy that echos the content of the original url with a content header set to javascript. — Niki van Stein, Dec 10 '15 at 16:27
@BasvanStein that seems reasonable!! Will let you know how it goes. Thanks — Steve Robinson, Dec 11 '15 at 11:45

score 0 · Answer 1 · edited May 23 '17 at 10:27

0

In case of iFrame, it can be possible to verify the domain that "call" the iframe using the referer. See How to limit display of iframe from an external site to specific domains only

edited May 23 '17 at 10:27

Community

1
1

answered Dec 10 '15 at 16:30

aprovent

941
6
20

Actually, I dont control the iframe's source application. It might be YouTube, Vimeo etc. So, there's no way for me to restrict those iframes from rendering in certain domains only :) – Steve Robinson Dec 11 '15 at 11:44

Authenticating URLs in iframe src and script src

1 Answers1