Support "Signed URLs" and "Allowed Origins"

Created on 7 December 2023, about 1 year ago
Updated 3 July 2024, 6 months ago

Cloudflare Stream supports "Signed URLs" and "Allowed Origins" to restrict the visibility of the player.

It would be great to support this feature. "Allowed Origins" should probably be a site settings configuration whereas "Signed URLs" should be a per entity configuration. When "Signed URLs", a token must be generated and used in place of the Video ID in the player url. The duration of this token can be configured and should probably be a site settings configuration.

Feature request
Status

Active

Version

3.0

Component

Code

Created by

🇫🇷France vbouchet

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @vbouchet
  • 🇫🇷France vbouchet

    Is 2.x-dev the proper branch for this?

  • 🇫🇷France vbouchet

    Switching to 3.0.x-dev as it seems to be the default branch.

  • 🇧🇪Belgium tim-diels Belgium 🇧🇪

    Hi vbouchet, sorry for the late reaction. The 3.x branch is with a new authentication method and we were waiting on feedback from another issue #3269156: Auth error when using module to move forward with that branch. I'll gonna have to take a look and test myself, or if you can help that would be helpfull.

    We can provide the feature for both branches if needed. But maybe lets first see what branch needs to be the default and then we can decide to maybe only do this for the 3.x branch.

  • 🇫🇷France vbouchet

    I will check and maybe reopen the ticket. I confirm that I used the Bearer approach with Postman on my local to test and struggled a little bit to setup the module on my local with 2.x branch. I think today the module is using API key which I think may give too much permission, whereas API token can be restricted to Stream read/write only.

    In the meantime, switching this issue to 3.x-dev.

  • 🇫🇷France vbouchet

    Hi tim-diels. I have reviewed the few places we are using the API getHeaders method and it seems all working well with the new auth method. I created a task (and a MR) to validate the token on form submit so we don't discover later the token is not valid.

  • 🇧🇪Belgium tim-diels Belgium 🇧🇪

    Hi vbouchet, great work. I love the new feature to verify the token! I'm going to try to clean up the 3.x branch as this is a wrong branch and the 3.0.x should be used. So switching this one to 3.0.x. I'm going to test now the other feature, but wanted to make sure we use the correct branches.

  • Hi! Any timeline for the release of 3.0.x? It'd be great to be able to use Signed URLs !

Production build 0.71.5 2024