Protect WMA stream/ASX with .htaccess?

wma asx .htaccess

[styx66]

I run a small site with a lot of audio recordings. When it first went up people started hotlinking straight to the URL's of my files, bypassing my login system and stats trackers.

I made an .htaccess in the files directory to deny all, and a download.php to read the file to the logged in user.

However, now I'd like the ability to stream the .wma's using a dynamically created .asx playlist.

If i add the file url to the asx playlist, i'm fairly sure it's going to be unauthorized.

So the question is, how can I allow access to authorized users through their media players?

Thanks in advance for any help you can give!

[jdMorgan]

"Hotlinking" implies referrer-checking, and medi players typically don't provide a referrer. Therefore, the solution is similar to your first one; Use a script to control access. But you'll need to track cookies, session IDs, IP addresses, or a combination of these to determine whether a user is "authorized."

This isn't something I've ever done, so the above is a general answer...

Jim

[styx66]

So this is what i tried:

Added .asx as a php processable file type, dynamically created .asx's. Created a 'streams' table in my db. In the asx 'script' i generated a random passkey linked to the user id. The URL in the asx pointed to a php script that would check the key, delete it, then readfile() the file to the player if the key matched.

Great in theory, but wouldn't work if i deleted the entry. I don't know how to explain it but if i ran a DELETE or UPDATE query in the script in any way shape or form, WMP wouldn't play. It was truly bizarre. I could paste the .asx URL into my browser and everything executed perfectly, including the download of the file.

Well anyway, i gave up eventually because there was no debugging path to follow. One thing didnt seem to have anything to do with the other.

So now i just have the IP of the .asx generator logged, and will only stream to the player if the $REMOTE_ADDR generated by the stream.php matches the IP in the DB. Works fine.