Hii, does live stream supports Hotlinking/Allowed Origins Protections

BBryanO Hello, I am experiencing an issue I can't solve. Essentially this link works and...

1

1984 Ford Laser•4/26/25, 12:45 AM

Have you tried using the HLS link from the video that gets generated by the live input?

JJessasaurus Hii, does live stream supports Hotlinking/Allowed Origins Protections

1

1984 Ford Laser•4/26/25, 12:46 AM

You can require signed tokens for live streams, or creating your own domain protection flow on the client-side

T

Timadiss•4/26/25, 11:38 AM

Hey folks. Is there any option to try Stream without buying a plan?

J

JessasaurusOP•4/26/25, 3:55 PM

Okay but how would had protect from someone finding the embed link in the code, and sharing it publicly

J

JessasaurusOP•4/26/25, 5:52 PM

trying to run the example Cloudflare Worker script to gererate the tokens the site is giving me this error "No event handlers were registered. This script does nothing."

JJessasaurus Okay but how would had protect from someone finding the embed link in the code, ...

1

1984 Ford Laser•4/27/25, 12:40 AM

You can do Allowed Origins Only on videos, so if you were to embed the vidoe generated by a live input once it goes live, you would be protected

11984 Ford Laser You can do Allowed Origins Only on videos, so if you were to embed the vidoe gen...

J

JessasaurusOP•4/27/25, 6:44 PM

Thats for uploaded videos no? not the live stream player?

JJessasaurus Thats for uploaded videos no? not the live stream player?

1

1984 Ford Laser•4/27/25, 9:03 PM

When a live stream starts, a video is generated. You can use the webhook which is fired when a stream starts, to find that video, and restrict its allowed origins. Then you would embed that video instead of the stream itself

11984 Ford Laser When a live stream starts, a video is generated. You can use the webhook which i...

J

JessasaurusOP•4/28/25, 7:08 AM

okay? how?

1

1984 Ford Laser•4/28/25, 7:10 AM

I would write a simple Worker that responds to the

stream.connected

stream.connected

webhook (or whatever its called) and make the necessary changes, and then embed it where necessary. That will depend on your specific needs/requirements

J

JessasaurusOP•4/28/25, 7:14 AM

okay? again how?? never used workers or Cloudflare in general, only requirements to protect what will be a pay to watch live stream

1

1984 Ford Laser•4/28/25, 7:23 AM

sorry I can't write the code for you. You could just edit the origins and embed after the live video has been created, allow some of 'pre-show' to do so

1

1984 Ford Laser•4/28/25, 7:25 AM

Does this page help at all, if you haven't read it already? https://developers.cloudflare.com/stream/viewing-videos/securing-your-stream/#_top

Cloudflare Docs

Secure your Stream · Cloudflare Stream docs

By default, videos on Stream can be viewed by anyone with just a video id. If you want to make your video private by default and only give access to certain users, you can use the signed URL feature. When you mark a video to require signed URL, it can no longer be accessed publicly with only the video id. Instead, the user will need a signed url...

1

1984 Ford Laser•4/28/25, 7:25 AM

Your front-end page would call a

/token

/token

endpoint provided by Stream, to be able to only render the stream if your UI provides the correct credentials

1

1984 Ford Laser•4/28/25, 7:27 AM

That would still require setting the video's

requiredSignedURLs

requiredSignedURLs

to

true

true

, but those calls can be easily done from curl or anything not necessarily a worker

11984 Ford Laser Does this page help at all, if you haven't read it already? https://developers.c...

J

JessasaurusOP•4/28/25, 8:42 AM

Yes i have already looked at that.. i go back to my other comment of "trying to run the example Cloudflare Worker script to gererate the tokens the site is giving me this error "No event handlers were registered. This script does nothing.""

1

1984 Ford Laser•4/28/25, 8:50 AM

What is your code? Have you tried asking AI?

J

JessasaurusOP•4/28/25, 8:51 AM

What code???

1

1984 Ford Laser•4/28/25, 8:51 AM

The code youre working with thats giving the error?

1

1984 Ford Laser•4/28/25, 8:51 AM

Like Im not sure which example script you are refering to exactly as there are plenty to choose from

J

JessasaurusOP•4/28/25, 8:52 AM

its on the link you posted.... https://developers.cloudflare.com/stream/viewing-videos/securing-your-stream/#step-2-generate-tokens-using-the-key

Cloudflare Docs

Secure your Stream · Cloudflare Stream docs

By default, videos on Stream can be viewed by anyone with just a video id. If you want to make your video private by default and only give access to certain users, you can use the signed URL feature. When you mark a video to require signed URL, it can no longer be accessed publicly with only the video id. Instead, the user will need a signed url...

1

1984 Ford Laser•4/28/25, 8:52 AM

Yeah that isn't an entire Worker script on its own, thats just a code snippet to demonstrate how to do that specific feature. You would want to have that snippet within the

fetch()

fetch()

handler of a Worker script

J

JessasaurusOP•4/28/25, 8:54 AM

that dosen't help in any way....

1

1984 Ford Laser•4/28/25, 8:57 AM

I haven't tested it, but if you deploy something like this

export default {
  async fetch(request, env) {
    // Global variables
        const jwkKey = "{PRIVATE-KEY-IN-JWK-FORMAT}";
        const keyID = "<KEY_ID>";
        const videoUID = "<VIDEO_UID>";
        // expiresTimeInS is the expired time in second of the video
        const expiresTimeInS = 3600;
        
        const encoder = new TextEncoder();
        const expiresIn = Math.floor(Date.now() / 1000) + expiresTimeInS;
        const headers = {
          alg: "RS256",
          kid: keyID,
        };
        const data = {
          sub: videoUID,
          kid: keyID,
          exp: expiresIn,
          accessRules: [
            {
              type: "ip.geoip.country",
              action: "allow",
              country: ["GB"],
            },
            {
              type: "any",
              action: "block",
            },
          ],
        };
      
        const token = `${objectToBase64url(headers)}.${objectToBase64url(data)}`;
      
        const jwk = JSON.parse(atob(jwkKey));
      
        const key = await crypto.subtle.importKey(
          "jwk",
          jwk,
          {
            name: "RSASSA-PKCS1-v1_5",
            hash: "SHA-256",
          },
          false,
          ["sign"],
        );
      
        const signature = await crypto.subtle.sign(
          { name: "RSASSA-PKCS1-v1_5" },
          key,
          encoder.encode(token),
        );
      
        const signedToken = `${token}.${arrayBufferToBase64Url(signature)}`;
      
        return signedToken;
        
        // Utilities functions
        function arrayBufferToBase64Url(buffer) {
          return btoa(String.fromCharCode(...new Uint8Array(buffer)))
            .replace(/=/g, "")
            .replace(/\+/g, "-")
            .replace(/\//g, "_");
        }
        
        function objectToBase64url(payload) {
          return arrayBufferToBase64Url(
            new TextEncoder().encode(JSON.stringify(payload)),
          );
        }
  },
};

export default {
  async fetch(request, env) {
    // Global variables
        const jwkKey = "{PRIVATE-KEY-IN-JWK-FORMAT}";
        const keyID = "<KEY_ID>";
        const videoUID = "<VIDEO_UID>";
        // expiresTimeInS is the expired time in second of the video
        const expiresTimeInS = 3600;
        
        const encoder = new TextEncoder();
        const expiresIn = Math.floor(Date.now() / 1000) + expiresTimeInS;
        const headers = {
          alg: "RS256",
          kid: keyID,
        };
        const data = {
          sub: videoUID,
          kid: keyID,
          exp: expiresIn,
          accessRules: [
            {
              type: "ip.geoip.country",
              action: "allow",
              country: ["GB"],
            },
            {
              type: "any",
              action: "block",
            },
          ],
        };
      
        const token = `${objectToBase64url(headers)}.${objectToBase64url(data)}`;
      
        const jwk = JSON.parse(atob(jwkKey));
      
        const key = await crypto.subtle.importKey(
          "jwk",
          jwk,
          {
            name: "RSASSA-PKCS1-v1_5",
            hash: "SHA-256",
          },
          false,
          ["sign"],
        );
      
        const signature = await crypto.subtle.sign(
          { name: "RSASSA-PKCS1-v1_5" },
          key,
          encoder.encode(token),
        );
      
        const signedToken = `${token}.${arrayBufferToBase64Url(signature)}`;
      
        return signedToken;
        
        // Utilities functions
        function arrayBufferToBase64Url(buffer) {
          return btoa(String.fromCharCode(...new Uint8Array(buffer)))
            .replace(/=/g, "")
            .replace(/\+/g, "-")
            .replace(/\//g, "_");
        }
        
        function objectToBase64url(payload) {
          return arrayBufferToBase64Url(
            new TextEncoder().encode(JSON.stringify(payload)),
          );
        }
  },
};

export default {
  async fetch(request, env) {
    // Global variables
        const jwkKey = "{PRIVATE-KEY-IN-JWK-FORMAT}";
        const keyID = "<KEY_ID>";
        const videoUID = "<VIDEO_UID>";
        // expiresTimeInS is the expired time in second of the video
        const expiresTimeInS = 3600;
        
        const encoder = new TextEncoder();
        const expiresIn = Math.floor(Date.now() / 1000) + expiresTimeInS;
        const headers = {
          alg: "RS256",
          kid: keyID,
        };
        const data = {
          sub: videoUID,
          kid: keyID,
          exp: expiresIn,
          accessRules: [
            {
              type: "ip.geoip.country",
              action: "allow",
              country: ["GB"],
            },
            {
              type: "any",
              action: "block",
            },
          ],
        };
      
        const token = `${objectToBase64url(headers)}.${objectToBase64url(data)}`;
      
        const jwk = JSON.parse(atob(jwkKey));
      
        const key = await crypto.subtle.importKey(
          "jwk",
          jwk,
          {
            name: "RSASSA-PKCS1-v1_5",
            hash: "SHA-256",
          },
          false,
          ["sign"],
        );
      
        const signature = await crypto.subtle.sign(
          { name: "RSASSA-PKCS1-v1_5" },
          key,
          encoder.encode(token),
        );
      
        const signedToken = `${token}.${arrayBufferToBase64Url(signature)}`;
      
        return signedToken;
        
        // Utilities functions
        function arrayBufferToBase64Url(buffer) {
          return btoa(String.fromCharCode(...new Uint8Array(buffer)))
            .replace(/=/g, "")
            .replace(/\+/g, "-")
            .replace(/\//g, "_");
        }
        
        function objectToBase64url(payload) {
          return arrayBufferToBase64Url(
            new TextEncoder().encode(JSON.stringify(payload)),
          );
        }
  },
};

export default {
  async fetch(request, env) {
    // Global variables
        const jwkKey = "{PRIVATE-KEY-IN-JWK-FORMAT}";
        const keyID = "<KEY_ID>";
        const videoUID = "<VIDEO_UID>";
        // expiresTimeInS is the expired time in second of the video
        const expiresTimeInS = 3600;
        
        const encoder = new TextEncoder();
        const expiresIn = Math.floor(Date.now() / 1000) + expiresTimeInS;
        const headers = {
          alg: "RS256",
          kid: keyID,
        };
        const data = {
          sub: videoUID,
          kid: keyID,
          exp: expiresIn,
          accessRules: [
            {
              type: "ip.geoip.country",
              action: "allow",
              country: ["GB"],
            },
            {
              type: "any",
              action: "block",
            },
          ],
        };
      
        const token = `${objectToBase64url(headers)}.${objectToBase64url(data)}`;
      
        const jwk = JSON.parse(atob(jwkKey));
      
        const key = await crypto.subtle.importKey(
          "jwk",
          jwk,
          {
            name: "RSASSA-PKCS1-v1_5",
            hash: "SHA-256",
          },
          false,
          ["sign"],
        );
      
        const signature = await crypto.subtle.sign(
          { name: "RSASSA-PKCS1-v1_5" },
          key,
          encoder.encode(token),
        );
      
        const signedToken = `${token}.${arrayBufferToBase64Url(signature)}`;
      
        return signedToken;
        
        // Utilities functions
        function arrayBufferToBase64Url(buffer) {
          return btoa(String.fromCharCode(...new Uint8Array(buffer)))
            .replace(/=/g, "")
            .replace(/\+/g, "-")
            .replace(/\//g, "_");
        }
        
        function objectToBase64url(payload) {
          return arrayBufferToBase64Url(
            new TextEncoder().encode(JSON.stringify(payload)),
          );
        }
  },
};

1

1984 Ford Laser•4/28/25, 8:57 AM

Look at the end of the day Cloudflare is a developers platform, there is only so much hand holding we can provide. #workers-and-pages-discussions will be a good place to get help with trying to run a Worker in general if that's where you're struggling

1

1984 Ford Laser•4/28/25, 9:01 AM

In your defense the documentation is spotty at the best of times (shit/not useful at the worst) and can be very daunting for newcomers

J

JessasaurusOP•4/28/25, 8:54 PM

when using signed token/urls how do you deal with the stopping/starting and that

JJessasaurus when using signed token/urls how do you deal with the stopping/starting and that

1

1984 Ford Laser•4/28/25, 10:36 PM

On the client side, the video player will fire events when playing stops/starts. You could use the start event to pull a new token or something

J

JessasaurusOP•4/28/25, 10:40 PM

i already do, i still notice audio/videos stops for like a spilt sec

A

ari•4/28/25, 11:31 PM

The AI-generated captions are a great feature addition! Excited to get closed captioning on our full library of videos. I set up an AI-powered process to compare the text in the Cloudflare-generated VTT file to the text in the original script used to produce the videos, and they're generally very accurate. The misses are expected and probably unavoidable: proper nouns. Unfortunately, one of the words consistently mis-transcribed is our company's name. So my AI-powered process generates a corrected VTT file intended to replace the AI-generated caption, but I've run into an unfortunate bug... It seems that once an AI-generated caption (English) is removed, a manually-updated VTT file (also English) doesn't appear in our player. The /captions/en endpoint returns a 404. Has anyone else bumped into this problem? I submitted a ticket, but figured good to also ask here.

Aari The AI-generated captions are a great feature addition! Excited to get closed ca...

1

1984 Ford Laser•4/28/25, 11:33 PM

When you call the

/captions

/captions

endpoint on the video, without the language tag, is there any listed caption file attached to the video?

11984 Ford Laser When you call the `/captions` endpoint on the video, without the language tag, i...

A

ari•4/28/25, 11:41 PM

Yes. Things look okay in the API. Here's what I see after manually-uploading caption:

[
  {
    "result": [
      {
        "language": "en",
        "label": "English",
        "generated": false,
        "status": "ready"
      }
    ],
    "success": true,
    "errors": [],
    "messages": []
  }
]

[
  {
    "result": [
      {
        "language": "en",
        "label": "English",
        "generated": false,
        "status": "ready"
      }
    ],
    "success": true,
    "errors": [],
    "messages": []
  }
]

[
  {
    "result": [
      {
        "language": "en",
        "label": "English",
        "generated": false,
        "status": "ready"
      }
    ],
    "success": true,
    "errors": [],
    "messages": []
  }
]

[
  {
    "result": [
      {
        "language": "en",
        "label": "English",
        "generated": false,
        "status": "ready"
      }
    ],
    "success": true,
    "errors": [],
    "messages": []
  }
]

1

1984 Ford Laser•4/28/25, 11:48 PM

Did you manually add that file before/after deleting the generated one? I'm not sure what's happening but wanna nail down what could cause it

1

1984 Ford Laser•4/28/25, 11:48 PM

Just out of curiosity, does the same thing happen when trying to upload that caption to another language?

A

ari•4/29/25, 12:02 AM

Issue only happens if an AI-generated caption was generated first. If the first upload was manually-generated, everything is fine.

A

ari•4/29/25, 12:04 AM

Can repro this outside of my video player, just by switching captions and visiting https://customer-....cloudflarestream.com/.../captions/en in a browser. Seems like there's a 1-2 minute (cache-related?) delay between when caption status shows as "Ready" and when the change is reflected in the browser, but setting aside the display, the issue is definitely replicable there.

J

JessasaurusOP•4/29/25, 12:09 AM

The live stream still stops whenever the signed token changes

A

ari•4/29/25, 12:10 AM

Related feature request: It would have been easier/faster to isolate the bug I was running into if the Stream video player embedded on the Captions page included a menu option to display closed captions.

1

1984 Ford Laser•4/29/25, 12:49 AM

That feels like such a Cloudflare oversight that the page for captions doesn't have a captions option for viewing

N

Neo•4/29/25, 9:04 AM

Hello everybody. I bought stream package and I have a question. Is there a way for rejecting abuse watches of our videos? For example someone can open videos continuously and bill will increase. Is there a way for protecting this?

NNeo Hello everybody. I bought stream package and I have a question. Is there a way f...

1

1984 Ford Laser•4/29/25, 9:23 AM

You would need to create your own flow of some sort. Creating signed tokens on your frontend or something

N

Neo•4/29/25, 10:08 AM

I see

J

JessasaurusOP•4/29/25, 10:26 AM

any knows the best way for stream player to handle when the signed tokens get refreshed, my player stops every time for like a 1 sec or 2

M

Mladenovic13•5/2/25, 7:35 PM

Hi, I’m encountering the error “The video duration exceeded the constraint set by the account holder” when uploading a video to Cloudflare Stream, even though the video is short (around 30 seconds). I’ve correctly set the upload metadata and the video is encoded with filetype: "video/mp4; codecs=avc1.42000a,mp4a.40.2". Could this be an issue with the encoding or is there a hidden duration constraint that I might be missing?

Any help would be greatly appreciated!

MMladenovic13 Hi, I’m encountering the error **“The video duration exceeded the constraint set...

1

1984 Ford Laser•5/2/25, 9:59 PM

Do you have an active Stream subscription?

M

Mladenovic13•5/2/25, 10:02 PM

Yes

M

Mladenovic13•5/2/25, 10:03 PM

Failed video UID: 5e65232ad456e7e96769771e1ec9578e

M

Mladenovic13•5/2/25, 10:05 PM

We never had this problem until iOS 18.4.1

1

1984 Ford Laser•5/2/25, 10:09 PM

So this issue only happens on iOS 18.4.1? You're uploading on the device, or just recording the video?

Hii, does live stream supports Hotlinking/Allowed Origins Protections

Similar Threads

Similar Threads

Similar Threads