Member Avatar for arjani10

Hello! I have an file php who want direct access in that file nobody can have access,i dn't know if is possible to block....

<?php
header("location:/path/?id=".$_GET['id']);
?>

i put that in an embed page and run video avi.when i block direct access with htaccess video dont run.Is possible block direct access and the video who get from header run??.
Thank you in advance .

  • 3 Contributors
  • 4 Replies
  • 222 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by arjani10

Dani AI

Generated

Short summary: is blocking direct hits but the player needs a direct GET (with byte-range support) to play. The session / POST ideas from and can gate normal pages, but they break embedded video because many players issue plain GETs (and need Range support) and cookies or POST flows are unreliable for an embedded resource.

Recommended pattern (works reliably)

  1. Protect the raw media so it cannot be fetched by guessing a URL (move it outside web root or deny the folder via server config).
  2. Serve media through a short-lived, signed URL handled by a server-side script (no session/cookie required). The embedder page generates a signed URL when rendering; the player requests that URL and the server-side script verifies signature + expiry and then hands the file to the webserver (X-Sendfile / X-Accel-Redirect) or implements HTTP Range handling itself. This avoids relying on HTTP_REFERER or base64 obfuscation, both of which are easily bypassed.

Example (conceptual)
Generate the signed URL on the page that outputs the embed tag:

<?php
define('SECRET','change_this_to_a_strong_random_secret');
$id = 'video123';
$exp = time() + 300; // valid 5 minutes
$payload = $id . '|' . $exp;
$sig = hash_hmac('sha256', $payload, SECRET);
$signed = '/stream.php?id=' . urlencode($id) . '&exp=' . $exp . '&sig=' . $sig;
?>
<!-- put $signed into your <embed>/<object>/<video> src -->

Verify and serve in stream.php:

<?php
define('SECRET','change_this_to_a_strong_random_secret');
$id = $_GET['id'] ?? '';
$exp = (int)($_GET['exp'] ?? 0);
$sig = $_GET['sig'] ?? '';
$payload = $id . '|' . $exp;
$expected = hash_hmac('sha256', $payload, SECRET);
if (!hash_equals($expected, $sig) || $exp < time()) { http_response_code(403); exit; }
// map $id -> filesystem path, check file exists.
// For performance and byte-range support, prefer sending an X-Sendfile / X-Accel-Redirect header here.
?>

Troubleshooting / cautions

  • HTML5 video requires byte-range support for seeking; pure readfile() without Range handling will break seeking. Use server-level sendfile modules where possible.
  • Do not rely on HTTP_REFERER or base64 as security.
  • Keep SECRET outside the repo and synchronized across servers; check server time drift (expiry depends on accurate clocks).
  • If embedding still fails after implementing the signed URL, inspect server logs for 403 and verify the full query string reaches stream.php unchanged (URL-encoding issues can strip the signature).

Recommended Answers

All 4 Replies

Member Avatar for sainigks

you can do it by using session. use session check. if session is empty redirect the user on other page.

Member Avatar for arjani10

Can i have an example for that please?Thank you .

Member Avatar for tomato.pgn 
<?php
if(isset($_POST['submit']))
{
//embedd video code here
}
else
{
?>
<form action="" Method="POST">
<input type="submit" value="submit" name="submit">
</form>
<?php 
?>

or using session

check if the session is set using same method but only difference is that for session you have to start session using session_start() and it must be the first code of your line...
For more refer here or here

Hope this is useful for you...
PS-If your problem is solved mark the thread as solved....

Edited by tomato.pgn because: n/a
Member Avatar for arjani10

Thanks tomato.pgn but i thing you dont understand that i need..


this is my header.php

1.
      <?php
   2.
      header("location:/path/?id=".$_GET['id']);
   3.
      ?>

and this is my embed.php code

<param name="Src" value="stream.php?id=<?php echo urlencode(base64_encode("http://mywebsite.com/header.php?id=$id&")); ?>" />

i need when click http://mywebsite.com/header.php?id=myid get no access ,but when i embed in my page that video run.Thats all.
Thank you anyway for your time.

Edited by arjani10 because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.