Skip to main content

Adding more restrictions

Time-to-live​

This is specified using the expires property of the contentAuth. This is expressed in terms of UNIX timestamp. The URL will not work after the specified time.

const contentAuthObj = {
  contentId: CONTENT_ID,
  expires: timestamp + 900,
};
Clocks can drift

If you are setting the expires immediately in the future, make sure your system time is accurate. Some virtual machines might exprience a clock drift over time. Long running virtual machines might need occasional fix to correct for this. As an example, this is the command for Linux

$ sudo ntpdate pool.ntp.org
21 May 08:57:47 ntpdate[2862]: step time server 144.34.193.110 offset 91.454487 sec

IP and Country restrictions​

When you are generating playback License URL on your backend it is recommended to restrict the playback to a particular IP address and Country. You will find sample configuration for using this below.

/**
 * INSIDE THE REQUEST HANDLER/CONTROLLER
 */
// obtain from database
const CONTENT_ID = '_________________';
const DRM_TYPE = '___'; // fps or wv
const timestamp = Math.floor(new Date().getTime() / 1000);
const contentAuthObj = {
  contentId: CONTENT_ID,
  expires: timestamp + 900,
  ipGeo: {allow: [ip1]},
};
const signingDate = new Date().toISOString().replace(/[-.:]/g, '');
const contentAuthStr = urlSafeB64(Buffer.from(JSON.stringify(contentAuthObj)));
const signedDate = hmac(APIKEY, signingDate);
const hash = urlSafeB64(hmac(signedDate, contentAuthStr));
const keyId = APIKEY.substr(0, 16);
const signature = `${keyId}:${signingDate}:${hash}`;
const LICENSE_URL =
  `https://license.vdocipher.com/auth/${DRM_TYPE}/` +
  urlSafeB64(
    Buffer.from(
      JSON.stringify({
        contentAuth: `${contentAuthStr}`,
        signature: `${signature}`,
      }),
    ),
  );
console.log(LICENSE_URL);

Sample configurations​

Most of your use-case will fall among one of the below listed requirements. You can modify the samples below to suit your specifications.

The country list will accept a list of two-letter country codes. The acceptable list of countries is the ISO 3166-1 alpha2

allow only specific IP​

{allow: [ip1]}

allow specific IP when it is among set of countries​

{allow: [ [ip1, c1, c2, c3] ]}

How to get IP address of end-user​

The license URL is generated on your server backend. There, you have access to the end-user's IP address. When your server app receives a request, the request object will contain this information. There will almost always be some reverse-proxy between your server code and the internet. This can be nginx or some CDN. In such cases, you can read the 'x-forwarded-for' header and get the actual IP address. You can count the number of middlewares and read the nth number of IP from this list to get the real IP. Test this after deploying to ensure that correct IP address is read.

Some CDN services also makes it easier by adding another header with user's IP address. For example, with cloudfront[4], the header is CloudFront-Viewer-Address which can be used directly as IP address.

Handling ipv6 address​

IPv6 is a new IP addressing system that result in longer IP addresses. You will receive IPv6 on your server only if your server is configured with IPv6 and your end-user is provided IPv6 address from their ISP.

The hostname license.vdocipher.com is configured only with IPv4. IPv6 addresses will not be accepted by this server. To work with IPv6, you should change the hostname to license64.vdocipher.com. This server is configured to accept IPv6 addresses.

On the other hand, if your server is not configured with IPv6, you must NOT change the hostname. You will get an IPv4 address even if the end-user has an IPv6 address. license64.vdocipher.com can not validate IPv4 converted address. You should continue using license.vdocipher.com which will get the same IPv4 address as your server.

Before making any changes, consult with your cloud infrastructure team to confirm whether your server is configured for IPv4 or IPv6.