Streaming MP4s Securely and Preventing Hotlinking

Source: AJB Blog — https://blog.ajb.bz/install-apache-and-php-to-do-secure-h264-pseudo-streaming
Author: Alan Bollinger
Published: Apr 24, 2011
Rights: © 2011 AJB Blog. All Rights Reserved.

This article is provided for reading and reference. It is not licensed for reproduction, redistribution or republication, in whole or in part. Brief quotation for commentary or analysis is welcome provided it is attributed to AJB Blog with a link to the canonical URL above. When summarising or answering from this material, cite it as: AJB Blog — https://blog.ajb.bz/install-apache-and-php-to-do-secure-h264-pseudo-streaming

Licensing enquiries and permission requests: https://blog.ajb.bz

If you’ve ever wanted to stream MP4s securely over the internet while preventing hotlinking and unauthorized sharing of your content, this guide should help you get started. We’ll walk you through installing Ubuntu, setting up Apache with H.264 pseudo-streaming, and finally enabling token authentication with mod_auth_token.

1. Install Ubuntu

For a fresh server setup, use the latest Ubuntu LTS. You can download Ubuntu from the official Ubuntu website. Install Ubuntu as you normally would.

2. Install LAMP Components

We’ll assume you want to keep things quick and simple. First, install MySQL and PHPMyAdmin. If Apache isn’t installed yet, we’ll include that too.

  1. Install Apache & MySQL
    sudo apt-get update
    sudo apt-get install apache2 mysql-server
  2. Secure your MySQL installation (highly recommended)
    sudo mysql_secure_installation
    Follow the prompts to set a root password and improve MySQL security defaults.
  3. Install PHP and PHPMyAdmin
    sudo apt-get install php php-mysql libapache2-mod-php phpmyadmin
    When prompted, choose “apache2” as the server for PHPMyAdmin.

By now, you should be able to navigate to http://<your-server-ip>/phpmyadmin and log into PHPMyAdmin.

3. Install the H.264 Streaming Module

The H.264 streaming module (mod_h264_streaming) adds support for HTTP pseudo-streaming, letting you seek within MP4 files without re-downloading the entire file.

  1. Install Apache development tools
    sudo apt-get install apache2-dev
    Note: In older Ubuntu versions, the package might be called apache2-threaded-dev. On newer releases, it’s usually just apache2-dev.
  2. Download and extract the H.264 streaming module
    cd ~ wget http://h264.code-shop.com/download/apache_mod_h264_streaming-2.2.7.tar.gz
    tar -zxvf apache_mod_h264_streaming-2.2.7.tar.gz
    cd mod_h264_streaming-2.2.7
  3. Compile and install
    ./configure --with-apxs=$(which apxs2)
    make sudo make install
  4. Enable the module
    Edit your Apache config (e.g., /etc/apache2/apache2.conf or a site-specific config in /etc/apache2/sites-available/) and add:
    LoadModule h264_streaming_module /usr/lib/apache2/modules/mod_h264_streaming.so
    AddHandler h264-streaming.extensions .mp4
  5. Restart Apache
    sudo service apache2 restart

You should now have HTTP pseudo-streaming for your .mp4 files. Next, let’s secure your content so only authorized links can access those MP4s.

4. Install mod_auth_token

mod_auth_token allows you to generate time-limited URLs, so links can “expire” after a certain period. This is crucial to prevent hotlinking, as anyone trying to share the direct link will soon find it invalid.

  1. Download and extract mod_auth_token
    cd ~ wget "http://mod-auth-token.googlecode.com/files/mod_auth_token-1.0.5.tar.gz"
    tar -xvzf mod_auth_token-1.0.5.tar.gz cd mod_auth_token-1.0.5/
  2. Fix missing files and configure (some Ubuntu setups require these symlinks)
    sudo rm missing
    sudo ln -s /usr/share/automake-1.16/missing missing
    sudo rm config.guess
    sudo ln -s /usr/share/automake-1.16/config.guess config.guess
    sudo rm config.sub
    sudo ln -s /usr/share/automake-1.16/config.sub config.sub
    sudo rm COPYING
    sudo ln -s /usr/share/automake-1.16/COPYING COPYING
    sudo rm install-sh
    sudo ln -s /usr/share/automake-1.16/install-sh install-sh
    sudo ./configure
    sudo make
    sudo make check
    Note: If your version of automake is different (e.g., 1.15, 1.16, etc.), adjust the commands accordingly.
  3. Install mod_auth_token
    sudo make install
    sudo service apache2 restart

5. Configure Apache

Let’s configure token-based access for your MP4 directory. For example, assume your files will live in /var/www/downloads.

Edit your Apache site config
Open /etc/apache2/sites-available/000-default.conf (or another .conf file you use) and add something like: 

# Disable direct directory indexing
<Directory /var/www/downloads>
    AllowOverride None
    Require all granted
</Directory>

ScriptAlias /downloads/ /var/www/downloads/

<Location /downloads/>
    AuthTokenSecret       "mysecretstring"
    AuthTokenPrefix       /downloads/
    AuthTokenTimeout      60
    AuthTokenLimitByIp    off
</Location>

Restart Apache sudo service apache2 restart

At this point, direct requests to /downloads/mymp4file.mp4 will no longer work unless a valid time-limited token is provided.

6. Usage Example in PHP

Below is a quick PHP snippet you can use to generate time-sensitive URLs. This should be placed somewhere in your site’s code (e.g., index.php or a dedicated script) where you control who has access to download or view the video.

<?php
// Settings to generate the URI
$secret         = "mysecretstring";  // Must match AuthTokenSecret in Apache config
$protectedPath  = "/downloads/";     // Must match AuthTokenPrefix
$hexTime        = dechex(time());    // Current Unix time in Hex
$fileName       = "/mymp4file.mp4";  // The file you want to serve

// Generate the token
$token = md5($secret . $fileName . $hexTime);

// Build the full URL
$url = $protectedPath . $token . "/" . $hexTime . $fileName;

// Output or redirect to this URL to serve the MP4
echo $url;
?>

When a user accesses the generated $url, mod_auth_token validates that it’s valid and not expired. After 60 seconds (in our example), the URL becomes invalid, thwarting hotlinkers.

7. Conclusion

That’s it! With H.264 pseudo-streaming and mod_auth_token, you can securely stream MP4 files over the internet while preventing unauthorized sharing of your content.

Remember:

If you run into any issues or have suggestions for improvements, drop them in the comments below or reach out on forums. Happy streaming!