5

We have made a silverlight application where users can preview audio files from their browser from the telerik radmediaplayer control.

The files are on a webserver and anyone who sniffs the trafic can download the file. We would like to prevent non-logged-in users from accessing/downloading these files.

Besides providing the application with some sort of temporary valid url and implementing a custom httphandler... what are our options?

It's not too big of a problem if our customers can download the files, we just don't want the rest of the world to also have access.

Any ideas would be more than welcome!

[Update] The only thing I can come up with is:

  • host the files in a non-public folder
  • if a user requests to prelisten a file, copy it to a public folder under a new name ([guid].mp3) and return it's url
  • every x minutes clean the public folder.

1 Answer 1

3
+50

Don't let the web server serve up the files straight out of a directory. Put part of your application in front, and left one of your server-side scripts serve up these files. Keep the raw audio files out of the web root.

For instance, your client-side application would access files like so:

http://someserver/yourscript?audio_asset_id=12345

The code at yourscript would verify the session data, ensuring that a user is logged in, would then go figure out the real path to asset ID 12345, and echo its contents to the client. Don't forget to include the proper Content-Type header as well.

Once the accessing of these assets is under your control, you can implement whatever security measures you like. If your sessions area already pretty well safe-guarded, this should be fine. I would also recommend implementing sane quotas. If you get 100 requests on an asset using the same session ID from multiple IP addresses... something isn't right.

4
  • I think your answer only masks the direct url in the html/xaml in the application. In the end it still returns the actual (sniffable) url to the player like for instance "bla.com/media/1.aac"; and the user would be able to guess that there is a "bla.com/media/2.aac". So this would not prevent anyone from downloading this file (even if they are not logged in). I just updated the problem with an approach that I think might work but still does not seem very pragmatic. Sep 3, 2012 at 13:27
  • 1
    Please re-read the last paragraph. Of course it prevents people from downloading the file when they are not logged in. You write the code that checks your user data in session, to verify that they have permissions. No, it won't prevent authorized users from actually getting the file sent to the browser. That is impossible. But, if you read my answer again, I think you will find it to be a perfectly workable solution (and one that other sites, such as Pandora, use every day). What you propose in your question is actually much more of a hassle and provides no protection for you.
    – Brad
    Sep 3, 2012 at 20:21
  • 1
    Sjors, are you missing out on one of the steps Brad mentions, or are you uncomfortable with the solution Brad offers? If so, why won't it work for you?
    – Simon
    Sep 6, 2012 at 13:23
  • 2
    I mean, it looks as if you see it like this (2 requests): - Player requests for a media file on the server (say on someserver/yourscript?audio_asset_id=12345). - Server responds with a URL to the media file (e.g. item12345.mp3). - Player requests the media file, using the given URL. - Server responds with the media file. Instead of (one request): - Player requests for a media file on the server (someserver/yourscript?audio_asset_id=12345) - Server looks up the item12345.mp3 file - Server responds the contents of the item12345.mp3 with Content-Type=audio/mp3 (or so)
    – Simon
    Sep 6, 2012 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.