Video protection: cloudfront or self-hosted?

Hi all,

During testing I found out that a self-hosted video (../s2member-files/video.mp4) cannot be approached without logging in. While a video hosted on Cloudfront can be accessed right away: d11111111.cloudfront.net/video.mp4?Policy=te5yet…

Am I missing something or is a self-hosted video ‘safer’? Or should I add extra protection to my Cloudfront settings somehow?!

By the way, I do understand HTML5 is far less safe than flash.
Thanks for your advice!

Hi Bjorn,

Have you configured an Amazon S3 bucket for your files in Dashboard -› s2Member® -› Download Options -› Amazon® S3/CDN Storage and configured your CloudFront settings in Dashboard -› s2Member® -› Download Options -› Amazon® S3/CloudFront CDN Storage? The level of protection is the same whether you’re storing locally (in s2member-files/) or on Amazon/CloudFront.

Thanks for quick response. Yes, all is setup and working. But, fall back mode is either a link to ../s2member-files directory (self hosted) -> it has download protection by s2member. Or a link to the Cloudfront distribution -> in my case I copy a direct link to the file (found in the source code including keys) in the download distribution, which isn’t protected by s2member. I tested this by copying this incredible large link, pasting it in a different browser (not logged in) and getting the file by download without problem.

Am I missing something?

Am I missing something or is a self-hosted video ‘safer’? Or should I add extra protection to my Cloudfront settings somehow?!

Yeah, you should edit the permissions for the bucket you integrate with s2Member, so that files can’t be accessed directly, only through s2Member because it adds an authentication that permits temporary access to the file.

Ok Cristián thanks. I hoped S2member would configure this automatically. Is there any tutorial available how I could do this by myself?

It’s a great product and I am very happy with your support! Proud customer!

Is there any tutorial available how I could do this by myself?

You may want to check out the video tutorial here:

http://www.s2member.com/videos/BD496E5F2CCAB12A/

Jason goes over setting up the Amazon S3 Cloudfront with JW Player, but you can adopt these changes to work with just downloads pretty easily.

Yeah, you should edit the permissions for the bucket you integrate with s2Member, so that files can’t be accessed directly, only through s2Member because it adds an authentication that permits temporary access to the file.

Any suggestions how to configure this? I have Cloudfront / JW player up and running well…
Thanks!

Any suggestions how to configure this? I have Cloudfront / JW player up and running well…
Thanks!

If you check the box under Dashboard -› s2Member® -› Download Options -› Amazon® S3/CloudFront CDN Storage labeled Yes, automatically configure my Amazon® CloudFront Distributions & Amazon® S3 ACLs for me., s2Member should automatically set this up for you.

If you check the box under Dashboard -› s2Member® -› Download Options -› Amazon® S3/CloudFront CDN Storage labeled Yes, automatically configure my Amazon® CloudFront Distributions & Amazon® S3 ACLs for me., s2Member should automatically set this up for you.

This is exactly what I have done. It works. But the fallback link to the download distribution on Cloudfront is not protected. If you copy the source code link of the fallback (which looks like: d11111.cloudfront.net/video.mp4?Policy=11111?signature=11111?key-pair-id=11111) and you paste it in a browser on a different computer it is accessible. Is this normal, or is there still something I am overseeing?

If you copy the source code link of the fallback (which looks like: d11111.cloudfront.net/video.mp4?Policy=11111?signature=11111?key-pair-id=11111) and you paste it in a browser on a different computer it is accessible. Is this normal, or is there still something I am overseeing?

This is the expected behavior, as Amazon is allowing connections to this URL for a designated amount of time with this signature. A user should only be able to access the file through this URL for a specific amount of time, which I believe depends on the file size, set up by Amazon.

For anyone looking to set expiration time in the signed url with CloudFront, please use this hack by Jason. Thanks for help all.
Expiration Time / Cloudfront hack

• This reply was modified 4 years, 1 month ago by  BoMember.