How to Implement Tokenized HLS Streaming Using the Nginx Secure Link Module

nginx -V 2>&1 | grep -o with-http_secure_link_module

server {
    listen 443 ssl;
    server_name video.example.com;

    ssl_certificate     /etc/letsencrypt/live/[video.example.com/fullchain.pem](https://video.example.com/fullchain.pem);
    ssl_certificate_key /etc/letsencrypt/live/[video.example.com/privkey.pem](https://video.example.com/privkey.pem);

    root /var/www/hls;

    # ─── Secure Link Configuration ───────────────────────────────────────────
    # Format: md5(expires + URI + client_IP + secret)
    secure_link $arg_md5,$arg_expires;
    secure_link_md5 "$secure_link_expires$uri$remote_addr YourSuperSecretWord2026";

    # ─── Protect the HLS manifest (.m3u8) ────────────────────────────────────
    location ~* \.m3u8$ {
        if ($secure_link = "") { return 403; }   # Missing or invalid token
        if ($secure_link = "0") { return 410; }  # Token expired

        add_header Cache-Control "no-store, no-cache";
        add_header Access-Control-Allow-Origin "*";
        try_files $uri =404;
    }

    # ─── Protect individual TS segments ──────────────────────────────────────
    location ~* \.ts$ {
        if ($secure_link = "") { return 403; }
        if ($secure_link = "0") { return 410; }

        add_header Cache-Control "no-store";
        try_files $uri =404;
    }

    # ─── Protect the AES-128 decryption key ──────────────────────────────────
    location ~* \.key$ {
        if ($secure_link = "") { return 403; }
        if ($secure_link = "0") { return 410; }

        add_header Cache-Control "no-store, private";
        try_files $uri =404;
    }
}

<?php
function generateSecureLink(string $uri, string $clientIp, string $secret, int $ttl = 3600): string {
    $expires   = time() + $ttl;
    $hashInput = "{$expires}{$uri}{$clientIp} {$secret}";

    // Compute raw MD5 binary → Base64 → URL-safe
    $md5 = base64_encode(md5($hashInput, true));
    $md5 = strtr($md5, '+/', '-_');
    $md5 = rtrim($md5, '=');

    $baseUrl = "[https://video.example.com](https://video.example.com){$uri}";
    return "{$baseUrl}?md5={$md5}&expires={$expires}";
}

// Usage
$clientIp  = $_SERVER['REMOTE_ADDR'];
$secret    = 'YourSuperSecretWord2026';
$uri       = '/streams/movie/index.m3u8';

echo generateSecureLink($uri, $clientIp, $secret);
?>

import hashlib
import base64
import time
from urllib.parse import urlencode

def generate_secure_link(uri: str, client_ip: str, secret: str, ttl: int = 3600, base_url: str = "[https://video.example.com](https://video.example.com)") -> str:
    expires = int(time.time()) + ttl
    hash_input = f"{expires}{uri}{client_ip} {secret}"

    # MD5 raw binary → Base64 → URL-safe encoding
    raw_md5   = hashlib.md5(hash_input.encode()).digest()
    token     = base64.b64encode(raw_md5).decode()
    token     = token.replace('+', '-').replace('/', '_').rstrip('=')

    params = urlencode({"md5": token, "expires": expires})
    return f"{base_url}{uri}?{params}"

if __name__ == "__main__":
    url = generate_secure_link("/streams/movie/index.m3u8", "203.0.113.42", "YourSuperSecretWord2026")
    print(url)

<?php
function tokenizeManifest($manifestPath, $clientIp, $secret, $baseUrl, $ttl = 3600): string {
    $lines   = file($manifestPath, FILE_IGNORE_NEW_LINES);
    $expires = time() + $ttl;
    $output  = [];

    foreach ($lines as $line) {
        if (str_ends_with(trim($line), '.ts')) {
            $uri     = parse_url($line, PHP_URL_PATH) ?? $line;
            $input   = "{$expires}{$uri}{$clientIp} {$secret}";
            $token   = rtrim(strtr(base64_encode(md5($input, true)), '+/', '-_'), '=');
            $output[] = "{$baseUrl}{$uri}?md5={$token}&expires={$expires}";
        } elseif (str_contains($line, 'URI=')) {
            preg_match('/URI="([^"]+)"/', $line, $match);
            if (!empty($match[1])) {
                $keyUri  = parse_url($match[1], PHP_URL_PATH);
                $input   = "{$expires}{$keyUri}{$clientIp} {$secret}";
                $token   = rtrim(strtr(base64_encode(md5($input, true)), '+/', '-_'), '=');
                $newUri  = "{$baseUrl}{$keyUri}?md5={$token}&expires={$expires}";
                $line    = preg_replace('/URI="[^"]+"/', "URI=\"{$newUri}\"", $line);
            }
            $output[] = $line;
        } else {
            $output[] = $line;
        }
    }
    return implode("\n", $output);
}

header('Content-Type: application/vnd.apple.mpegurl');
echo tokenizeManifest('/var/www/hls/streams/movie/index.m3u8', $_SERVER['REMOTE_ADDR'], 'YourSuperSecretWord2026', '[https://video.example.com](https://video.example.com)');
?>