: How to include content from remote server while keeping that content secure I am hosting collection of videos, for which I retain the copyright, on a file server that I'd like to share with

@Annie201

Setup facebook connect on a WordPress site your family should know how to connect using facebook you simply click a button and accept the authentication. Pretty simple.

Vote Up Vote Down

@Si4351233

Here is a quick and dirty solution which trusts your users not to share the authentication for the back-end server.

I would never recommend this for a professional project, but it may be the sledgehammer you are lookingfor. It's possible to write urls with a username and password in to them. So from your web-app, with a trusted user logged in, you would write something like this:

<video src="ftp://username:password@remote.example.com/some/file/path.jpg" .. >


IE no longer supports this. Not sure about other browsers. So your users would have to comply.

Obviously anyone who inspects the source of your webapp can find the username & password in the clear. This is of course bad. All in all a dirty hack. But there it is for what it's worth.

I suppose the back-end server is dumb or I'd suggest an hmac shared-secret authentication token.

Vote Up Vote Down

@Frith620

I agree with @jeffatrackaid about:
"if you build a web application with a user login/pass function, you have handled the user authentication part."

The rest should be done as follows:
A. create the service that pulls the data from the remote server and supplies the streaming content.
B. on the remote server - restrict the access (by IP) so that only requests from your other server - will be served. All other http requests should be ignored.

Vote Up Vote Down

@Becky754

I don't quite have enough information to know exactly how you plan to setup your application, but a useful guideline is to split user-authentication from application-authentication.

For example, if you build a web application with a user login/pass function, you have handled the user authentication part. The only way someone can view that part of your web application is to authenticate.

Now say this app needs to fetch data elsewhere (pretty common with today's APIs). Your application then has to handle the authentication to the other resource.

The other route is to leave the web application open and have the authentication happen on the application side.

If this is all too much for your goals, consider a hosted solutions using password protected videos:
misternorris.com/2011/02/how-to-vimeo-and-password-protect/

Vote Up Vote Down

@Deb1703797

Sounds like making it easy for them is complicating it for you :-) Your question is quite generic so it's hard to be specific but it is possible though a variety of methods.

This link may get you going : blog.neutrino.es/2010/auth-external-the-swiss-army-knife-of-apache-auth/
Also checkout the various authentication modules at Apache : httpd.apache.org/docs/2.4/mod/
To get more help you need to be more specific.

Vote Up Vote Down