A friend of mine asked me how can I stop my users from downloading my videos directly, and I said okay, let me explain it to you :) and this post is what I found out and what it can be done.

The quick answer is you can’t technically,

For example, they can capture their screen in full-screen mode and download your video, not even from your servers.

However, not everyone does that, and it’s harder to do, so if you want to do the best you can follow me here:

Disable Right Click

Easy as it sounds, you can disable opening the right-click option on video and stop users from clicking on download!

noContext = document.getElementById('noContextMenu');
noContext.addEventListener('contextmenu', e => {
  e.preventDefault();
});

Use HTTP Live Streaming

Okay, this one isn’t as easy as the first one, but it’s more effective. To do this, you need to develop.

First, you need to convert your videos for example if they are mp4 to HLS format. Like this

ffmpeg -i input.mp4 -profile:v baseline -level 3.0 -s 640x360 -start_number 0 -hls_time 10 -hls_list_size 0 -f hls index.m3u8

Source: https://www.keycdn.com/support/how-to-convert-mp4-to-hls

Secondly, you need to use a .hls player like

https://github.com/video-dev/hls.js/

Not that hard, but it means more cost for a server to host your videos!

Canvas Video Player

The concept is easy, draw each frame of the video in your canvas. Yes, it is possible.

Take a look at this repo: https://gka.github.io/canvid

It is good enough to show your videos, but you need to style it to look better and you might also lose some of the functionalities.

CSRF for Videos

The concept is to set a CSRF token in the header of your request to get the source URL for the videos and make sure it’s one time only.

So if the user somehow tried to click on the link of the video directly from the browser, their CSRF token won’t be authorized.

Not ideal and I know there are different ways to go around it but you’re making it harder.

Conclusion

These methods might make it difficult for users to download your videos, but at the end of the day, it’s a matter of trust to your users.