HLS视频加密，让您的视频内容更安全！

<script src="./cos_hls.js"></script>
<script src="./hls.js"></script> 
<script src="./jsencrypt.js"></script>

<link href="https://web.sdk.qcloud.com/player/tcplayer/release/v4.2.2/tcplayer.min.css" rel="stylesheet"/>
<script src="https://web.sdk.qcloud.com/player/tcplayer/release/v4.2.2/libs/hls.min.0.13.2m.js"></script>
<script src="https://web.sdk.qcloud.com/player/tcplayer/release/v4.2.2/tcplayer.v4.2.2.min.js"></script>
<script src="./cos_hls.js"></script>
<script src="./jsencrypt.js"></script>

<link href="https://vjs.zencdn.net/8.11.8/video-js.css" rel="stylesheet" />
<script src="https://vjs.zencdn.net/8.11.8/video.js"></script>
<script src="./cos_hls.js"></script>
<script src="./jsencrypt.js"></script>

<script>
    // cosHLs为cos_hls.js封装的对象，使用play方法播放视频文件
    cosHls.play({
        // video标签的id
        container: 'video',
        // 支持的播放器种类（hls.js/tcplayer/video.js）
        playerType: 'hls.js',
        // 请求m3u8接口的文件地址
        src: 'https://examplebucket-1250000000.cos.ap-beijing.myqcloud.com/hls/video.m3u8?ci-process=pm3u8',
        // 标记src里的域名是不是CDN域名（false/true）
        // useCdn: false,
        // 请求token和签名的函数
        getToken(opt, callback) {
            // 加密公钥，不需要用户填写，sdk会自动生成
            var publicKey = opt.publicKey;
            // 请求m3u8接口的文件地址，不需要用户填写，sdk会自动生成
            var src = opt.src;
            // 是否返回加密内容，与cosHls对象的ProtectContentKey参数保持一致，不需要用户填写，sdk会自动生成
            var protectContentKey = opt.ProtectContentKey;
            // 新建xhr对象，进行请求
            var xhr = new XMLHttpRequest();
            xhr.withCredentials = true;
            // /samples/hls/token为自定义请求地址，用户可自自定义
            xhr.open('POST', `/hls/token`, true);
            xhr.setRequestHeader('Content-Type', 'application/json')
            // 请求成功返回authorization 和 token
            xhr.onload = function () {
                var r = JSON.parse(xhr.responseText);
                var authorization = r.authorization
                var token = r.token
                callback(null, {authorization, token});
            };
            xhr.onerror = function () {
                callback('get token error');
            };
            // node服务所需要的参数，已从sdk获取，不需要用户填写
            var data = {
                src: src,
                publicKey: window.btoa(publicKey),
                protectContentKey: protectContentKey
            };
            xhr.send(JSON.stringify(data));
        }
    })
</script>

const COS = require('cos-nodejs-sdk-v5');
const base64Url = require('base64-url');
const express = require('express');
const crypto = require('crypto');
// 配置参数

const config = {

// 获取腾讯云密钥，建议使用限定权限的子用户的密钥 https://console.cloud.tencent.com/cam/capi

secretId: process.env.SecretId,

secretKey: process.env.SecretKey,

// 播放秘钥，可在媒体处理模块获取 https://console.cloud.tencent.com/cos/bucket?bucket=xxxx-100000&region=ap-xxx&type=ci&anchorType=video

playKey: process.env.playKey,

// 目标存储桶名称，可在存储桶列表页获取 https://console.cloud.tencent.com/cos/bucket

bucket: 'xxx',

// 目标存储桶地域，可在存储桶列表页获取 https://console.cloud.tencent.com/cos/bucket

region: 'xxx'

};
// 创建临时密钥服务和用于调试的静态服务

const app = express();
app.use(bodyParser.json());

app.use(bodyParser.urlencoded({ extended: true }));
router.post('/hls/token', (req, res, next) => {

// 从接口拿到文件地址，加密公钥，是否返回加密内容

const body = req.body;

const src = body.src;

const publicKey = body.publicKey;

const protectContentKey = body.protectContentKey;
// 如在某些特殊场景需要用HLS标准加密(例如小程序里播放/iOSWebview)，可以去掉下面的限制判断并做好来源限制只允许小程序来源。
// 代码示例只允许 protectContentKey 传 1，原因：如果允许传入 0 播放流程会走 HLS 标准加密会有风险。
const userAgent = req.headers['user-agent'] || '';
const uaWhiteList = ['Safari', 'wechatdevtools', 'MiniProgramEnv'];
const isUaAllow = uaWhiteList.some(item => userAgent.includes(item));
// 只有白名单的浏览器，才能走标准加密
if (!protectContentKey && !isUaAllow) {
    res.status(400);
    return res.send({code: -1, message: 'protectContentKey=0 not allowed'});
}

// src 链接校验
if (!src || !srcReg.test(src)) return res.send({code: -1, message: 'src format error'});
if (!publicKey) return res.send({code: -1, message: 'publicKey empty'});

// 解析 url
const { bucket, region } = config;
const { token, authorization } = getToken({publicKey, protectContentKey, bucket, region, src}, res)
res.send({code: 0, message: 'ok', token, authorization});

});
const srcReg = /^https?://([^/]+)/([^?]+)/;

const ciHostReg = /^[^.]+.ci.[^.]+.myqcloud.com$/;
function getToken({publicKey, protectContentKey, bucket, region, src}) {

const m = src.match(srcReg);

const srcHost = m[1];

const pathKey = m[2];

const query = {};

const isCiHost = ciHostReg.test(srcHost);

src.replace(/^([^?]+)(?([^#]+))?(#.*)?$/, '$3').split('&').forEach(item => {

const index = item.indexOf('=');

const key = index > -1 ? item.slice(0, index) : item;

let val = index > -1 ? item.slice(index + 1) : '';

query[key] = decodeURIComponent(val);

});

let objectKey = isCiHost ? query.object : pathKey;

const header = {

"alg": "HS256",

"typ": "JWT"

}

const appId = bucket.slice(bucket.lastIndexOf('-') + 1);

let payload = {

Type: "CosCiToken",

AppId: appId,

BucketId: bucket,

Issuer: "client",

IssuedTimeStamp: Math.floor((new Date().getTime() - 30 * 1000) / 1000),

ProtectSchema: "rsa1024",

PublicKey: publicKey,

ProtectContentKey: protectContentKey || 0,

UsageLimit: 50,

Object: objectKey,

};

let Header = base64Url.encode(JSON.stringify(header))

let PayLoad = base64Url.encode(JSON.stringify(payload))

let data = Header + "." + PayLoad

let hash = crypto.createHmac('sha256', config.playKey).update(data).digest();

let Signature = base64Url.encode(hash);

let token = Header + '.' + PayLoad + '.' + Signature

let authorization = COS.getAuthorization({

SecretId: config.secretId,

SecretKey: config.secretKey,

Method: 'get',

Pathname: /${objectKey},

Query: {'ci-process': 'pm3u8'},

});

return {token, authorization};

}