-1

I need Hide the URL of an embedded video to prevent anyone from accessing the video outside of my domain. What I want to use Firebase Storage for, is to store and stream the videos which ONLY paid users logged into my site can access.

Is there any way I can hide the URL so that people can only access the videos from within my web page in wordpress? Thanks!

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
SASET SAS
  • 1
  • 1
    I think you're going to have a hard time with this. You can make it difficult, but you can't make it impossible to know a download URL that's been exposed to anyone for any reason. The best you could do is give it a limited lifetime. – Doug Stevenson Jan 18 '19 at 20:16

1 Answers1

0

As Doug said in his comment, it is impossible to completely hide a download URL. There are complicated ways to obscure it, but I would recommend you avoid going down that rabbit hole - none are foolproof.

Instead, you should implement your security using Firebase Storage's built-in security rules - the situation you are describing is EXACTLY what this feature is designed to accomplish. You can put a rule in place that only users who have purchased the course (meaning, they have that video's identifier under their account in the database) are granted access... and you can even limit access to your project (see steps in answer #1) to specific domains.

There are a ton of great resources out there for you to reference while learning how the security rules work. First would be the docs I linked earlier, but they also have some pretty good official Firebase Youtube videos on the subject of rules.

If you are talking about having the videos stored in Firebase, hopefully you are planning to use the rest of Firebase's back-end features... because the ONE BIG ISSUE with this suggestion is that it relies on you using Firebase's built-in authentication. If your users are already logging into your site via an established non-Firebase system you've added to your Wordpress site, then I'm afraid this solution won't be so simple. Not impossible, but not as simple. If that's the case, you will need to pass the customer information to Firebase to login to a duplicated customer account, even if the end user doesn't realize they are being logged in to Firebase, and THEN they will have that special auth token that Firebase security uses to identify & grant access with the security rules.

JeremyW
  • 5,157
  • 6
  • 29
  • 30