Security with vimeo domain privacy and </a></h1> </div> <div class="grid fw-wrap pb8 mb16 bb bc-black-075"> <div class="grid--cell ws-nowrap mr16 mb8" title="2016-01-12 19:07:53Z"> <span class="fc-light mr2">Asked</span> <time itemprop="dateCreated" datetime="2018-07-28T02:59:36.613" class="fromnow">Jul 28 '18 at 02:59</time> </div> <div class="grid--cell ws-nowrap mr16 mb8"> <span class="fc-light mr2">Active</span> <time class="fromnow" title="2022-07-14T09:29:04.240" datetime="2022-07-14T09:29:04.240">Jul 14 '22 at 09:29</a> </div> <div class="grid--cell ws-nowrap mb8" title="Viewed 4,960 times"> <span class="fc-light mr2">Viewed</span> 4,960 times </div> </div> <div id="mainbar" role="main" aria-label="questions and answers"> <div id="question" class="question" data-questionid="51567649" data-ownerid="10076619" data-score="9"> <div class="post-layout"> <div class="votecell post-layout--left"> <div class="js-voting-container grid jc-center fd-column ai-stretch gs4 fc-black-200" data-post-id="51567649"> <button class="js-vote-up-btn grid--cell s-btn s-btnunset c-pointer"><svg aria-hidden="true" class="m0 svg-icon iconArrowUpLg" width="36" height="36" viewBox="0 0 36 36"><path d="M2 26h32L18 10 2 26z"></path></svg></button> <div class="js-vote-count grid--cell fc-black-500 fs-title grid fd-column ai-center" itemprop="upvoteCount" data-value="9">9</div> <button class="js-bookmark-btn s-btn s-btnunset c-pointer py4"> <svg aria-hidden="true" class="svg-icon iconBookmark" width="18" height="18" viewBox="0 0 18 18"><path d="M6 1a2 2 0 00-2 2v14l5-4 5 4V3a2 2 0 00-2-2H6zm3.9 3.83h2.9l-2.35 1.7.9 2.77L9 7.59l-2.35 1.7.9-2.76-2.35-1.7h2.9L9 2.06l.9 2.77z"></path></svg> <div class="js-bookmark-count mt4" data-value="0">0</div> </button> </div> </div> <div class="postcell post-layout--right"> <div class="s-prose js-post-body" itemprop="text"><p>In our App users can subscribe to get access to "premium videos". We use vimeo to host all those videos using that domain protection setting that only allows our videos to be embedded in a specific domain. </p> <p>Our situation: <br/> If a ill-intended user subscribes for a month and use that access to get all the private videos IDs (something around 1500) using Firebug, chrome inspect or another tool like that, he can manually insert an iframe on our login page and since it's on the domain that is allowed by vimeo, the private video will play without any restriction. <br/> Making use of the stolen ids he can then create a plugin that can list all of our private videos for free on our own site :( <br/> Here's a code sample that someone can use to play a video on our domain just by inserting it using chrome inspect:</p> <pre><code><iframe src="https://player.vimeo.com/video/{any video ID including our domain protected ones}" width="640" height="640" frameborder="0" allowfullscreen=""></iframe> </code></pre> <p>My question: <br/> Is there a way to avoid or make it harder for someone to do this? <br/> A possible solution that we could think of was to create another domain to use as the domain for the videos (avoid using the same as login), but its possible to get that new domain on the network tab of chrome anyway.</p> <p>P.S: I don't know if that's relevant but we are using PhoneGap/Cordova to develop the app.</p></div> <div class="mt24 mb12"> <div class="post-taglist grid gs4 gsy fd-column"> <div class="grid ps-relative"> <a href="../../questions/tagged/iframe" class="post-tag js-gps-track" title="show questions tagged 'iframe'" rel="tag">iframe</a> <a href="../../questions/tagged/vimeo" class="post-tag js-gps-track" title="show questions tagged 'vimeo'" rel="tag">vimeo</a> <a href="../../questions/tagged/vimeo-api" class="post-tag js-gps-track" title="show questions tagged 'vimeo-api'" rel="tag">vimeo-api</a> </div> </div> </div> <div class="mb0"> <div class="mt16 grid gs8 gsy fw-wrap jc-end ai-start pt4 mb16"> <div class="grid--cell mr16 fl1 w96"></div> <div class="post-signature owner grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="asked Jul 28 '18 at 02:59">asked Jul 28 '18 at 02:59</time> <a href="../../users/10076619/edurox" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/10076619.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="Edurox" /> </a> <div class="s-user-card--info"> <a href="../../users/10076619/edurox" class="s-user-card--link">Edurox</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">307</li> <li class="s-award-bling s-award-blingsilver" title="3 silver badges">3</li> <li class="s-award-bling s-award-blingbronze" title="7 bronze badges">7</li> </ul> </div> </div> </div> </div> </div> </div> <div class="post-layout--right js-post-comments-component"> </div> </div> </div> <div id="answers"> <a name="tab-top"></a> <div id="answers-header"> <div class="answers-subheader grid ai-center mb8"> <div class="grid--cell fl1"> <h2 class="mb0" data-answercount="9">1 Answers<span style="display:none;" itemprop="answerCount">1</span></h2> </div> </div> </div> <a name="51677186"></a> <div id="answer-51677186" class="answer accepted-answer" data-answerid="51677186" data-ownerid="10076619" data-score="9" itemprop="acceptedAnswer" itemscope="" itemtype="https://schema.org/Answer"> <div class="post-layout"> <div class="votecell post-layout--left"> <div class="js-voting-container grid jc-center fd-column ai-stretch gs4 fc-black-200" data-post-id="51677186"> <button class="js-vote-up-btn grid--cell s-btn s-btnunset c-pointer"><svg aria-hidden="true" class="m0 svg-icon iconArrowUpLg" width="36" height="36" viewBox="0 0 36 36"><path d="M2 26h32L18 10 2 26z"></path></svg></button> <div class="js-vote-count grid--cell fc-black-500 fs-title grid fd-column ai-center" itemprop="upvoteCount" data-value="9">9</div> <div class="js-accepted-answer-indicator grid--cell fc-green-500 py6 mtn8"><div class="ta-center"><svg aria-hidden="true" class="svg-icon iconCheckmarkLg" width="36" height="36" viewBox="0 0 36 36"><path d="m6 14 8 8L30 6v8L14 30l-8-8v-8z"></path></svg></div></div> </div> </div> <div class="postcell post-layout--right"> <div class="s-prose js-post-body" itemprop="text"><p>After a research and a few answers from Vimeo support we found a solution that works for our case.</p> <p>Since there's no way to stop people from downloading your videos if they have access to them, we changed our strategy from using domain protection to using direct video links/urls (this requires upgrading your Vimeo account to Pro or higher).</p> <p>Read more in the Vimeo documentation:</p> <ul> <li><a class="external-link" href="https://vimeo.zendesk.com/hc/en-us/articles/224823567-Direct-links-to-video-files" rel="nofollow noreferrer">Direct links to video files</a></li> <li><a class="external-link" href="https://vimeo.zendesk.com/hc/en-us/articles/360042877811-Get-video-file-and-download-links-from-the-API" rel="nofollow noreferrer">Get video file and download links from the API</a></li> </ul> <p>When you get a direct video url (like <a class="external-link" href="https://player.vimeo.com/external/..." rel="nofollow noreferrer">https://player.vimeo.com/external/...</a>) and open it in a browser it redirects you to a temporary Url (answer from Vimeo: "Both the files and download links are HTTP 302 redirects to the actual video file resources. The location of the actual video file resources expires every few hours, so make sure you always use the redirect links we provide."). We can then use this temporary url in HTML5 video tag and play our videos.</p> <p>Notes:</p> <ol> <li><p>If a user steals our urls it will only work for a few hours and that way they wont be able to build a site with our videos using our Urls.</p> </li> <li><p>Unfortunately someone with some knowledge in web can download the videos easily using that direct video link, but since we can't avoid the videos to be downloaded anyway that wont be a big deal.</p> </li> <li><p>We need to get the temporary url server side, because we don't want anyone to access the original direct url (like <a class="external-link" href="https://player.vimeo.com/external/..." rel="nofollow noreferrer">https://player.vimeo.com/external/...</a>).</p> </li> </ol> <hr/> <p>Here's a code example in C# that gets that temporary url (based on <a href="../../questions/3836784/how-to-get-a-redirection-response#3836811">this</a>):</p> <pre><code> var url = "https://player.vimeo.com/external/..."; HttpWebRequest webRequest = (HttpWebRequest)WebRequest.Create(url); webRequest.AllowAutoRedirect = false; // IMPORTANT webRequest.UserAgent = "youruseragent"; webRequest.Timeout = 10000; // timeout 10s // Get the response ... using(var webResponse = (HttpWebResponse)webRequest.GetResponse()) { // Now look to see if it's a redirect if((int)webResponse.StatusCode >= 300 && (int)webResponse.StatusCode <= 399) { string uriString = webResponse.Headers["Location"]; System.Diagnostics.Debug.WriteLine("Redirect to " + uriString ?? "NULL"); } } </code></pre></div> <div class="mb0"> <div class="mt16 grid gs8 gsy fw-wrap jc-end ai-start pt4 mb16"> <div class="grid--cell mr16 fl1 w96"></div> <div class="post-signature grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="edited Jul 14 '22 at 09:29">edited Jul 14 '22 at 09:29</time> <a href="../../users/1268612/karl-horky" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/1268612.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="Karl Horky" /> </a> <div class="s-user-card--info"> <a href="../../users/1268612/karl-horky" class="s-user-card--link">Karl Horky</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">4,410</li> <li class="s-award-bling s-award-blinggold" title="2 gold badges">2</li> <li class="s-award-bling s-award-blingsilver" title="31 silver badges">31</li> <li class="s-award-bling s-award-blingbronze" title="35 bronze badges">35</li> </ul> </div> </div> </div> <div class="post-signature owner grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="answered Aug 03 '18 at 17:03">answered Aug 03 '18 at 17:03</time> <a href="../../users/10076619/edurox" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/10076619.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="Edurox" /> </a> <div class="s-user-card--info"> <a href="../../users/10076619/edurox" class="s-user-card--link">Edurox</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">307</li> <li class="s-award-bling s-award-blingsilver" title="3 silver badges">3</li> <li class="s-award-bling s-award-bling__bronze" title="7 bronze badges">7</li> </ul> </div> </div> </div> </div> </div> </div> <div class="post-layout--right js-post-comments-component"> <div id="comments-51677186" class="comments js-comments-container bt bc-black-075 mt12 " data-post-id="51677186" data-min-length="15"> <ul class="comments-list js-comments-list" data-remaining-comments-count="0" data-canpost="false" data-cansee="true" data-comments-unavailable="false" data-addlink-disabled="true"> <li id="comment-128894842" class="comment js-comment " data-comment-id="128894842" data-comment-owner-id="1268612" data-comment-score="0"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment128894842_51677186"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">Is this still valid? Do you have any reference to the Vimeo documentation for these "direct video url"s? The [Vimeo pricing page](https://vimeo.com/upgrade) mentions that even Plus also has access to something called "link-only access", but not sure if this is what you're referring to. Another potential feature match is [the Video review page feature](https://help.vimeo.com/hc/en-us/articles/224818367-Video-review-page-), which is restricted to Pro and higher</span> – <a href="../../users/1268612/karl-horky" title="4,410 reputation" class="comment-user ">Karl Horky</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/51567649/security-with-vimeo-domain-privacy-and-iframe#comment128894842_51677186"><span title="2022-07-14T08:25:32.873 License: CC BY-SA 4.0" class="relativetime-clean">Jul 14 '22 at 08:25</span></a></span> </div> </div> </li> <li id="comment-128895990" class="comment js-comment " data-comment-id="128895990" data-comment-owner-id="1268612" data-comment-score="1"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> <span title="number of 'useful comment' votes received" class="warm">1</span> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment128895990_51677186"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">Oh, maybe you're referring to [Direct links to video files](https://vimeo.zendesk.com/hc/en-us/articles/224823567-Direct-links-to-video-files) - available under Advanced Video Settings -> Distribution... I added the link to the docs in your answer above</span> – <a href="../../users/1268612/karl-horky" title="4,410 reputation" class="comment-user ">Karl Horky</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/51567649/security-with-vimeo-domain-privacy-and-iframe#comment128895990_51677186"><span title="2022-07-14T09:21:04.947 License: CC BY-SA 4.0" class="relativetime-clean">Jul 14 '22 at 09:21</span></a></span> </div> </div> </li> <li id="comment-128931570" class="comment js-comment " data-comment-id="128931570" data-comment-owner-id="10076619" data-comment-score="0"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment128931570_51677186"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">@KarlHorky Yes, as you said I'm referring to Direct links to video files, ty for the extra info =D</span> – <a href="../../users/10076619/edurox" title="307 reputation" class="comment-user owner">Edurox</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/51567649/security-with-vimeo-domain-privacy-and-iframe#comment128931570_51677186"><span title="2022-07-15T19:46:45.413 License: CC BY-SA 4.0" class="relativetime-clean">Jul 15 '22 at 19:46</span></a></span> </div> </div> </li> </ul> </div> </div> </div> </div> </div> </div> </div> </div> <script src="../../static/js/stack-icons.js"></script> <script src="../../static/js/fromnow.js"></script> </body> </html>