Video is the most expensive thing you serve and the easiest thing to steal. If an origin is publicly reachable, every cache, token, and access rule you configured at the edge can be bypassed by hitting the origin directly. Origin protection is the set of controls that keep the origin private, make playback URLs non-transferable, and stop egress theft before it becomes a bill.
Private origins
An origin should accept traffic only from your edge, never from the open internet. Common approaches:
- IP allow-listing the edge egress ranges at the origin firewall or object-storage policy.
- A shared secret header that the edge injects and the origin requires, with the origin rejecting requests that lack it.
- A private network path between edge and origin so no public route exists at all.
If the origin must stay reachable, at minimum require the secret header and reject anything else with a 403 rather than serving it. Verify protection by requesting an origin URL from a machine outside the edge and confirming it fails; an unprotected origin is the single most common cause of a sudden egress spike.
Signed playback
A signed URL or token proves that a specific viewer is entitled to a specific object for a limited time. Good signing has four properties:
- Scope — the signature covers the exact path and any binding parameters, not a whole domain.
- Expiry — short enough that a leaked URL is useless quickly, long enough to cover a full viewing session including seeks.
- Viewer binding — where feasible, tie the token to a session or device so it cannot be pasted elsewhere.
- Edge validation — the edge verifies the signature and rejects tampering before any cache or origin lookup.
Because manifests reference segment URLs, sign the manifest and the segments consistently. If segments are unsigned but the manifest is signed, a viewer can extract segment URLs and share them; if segments are signed per-request, confirm the player re-signs each one or that tokens cover the whole session.
Hotlink and leech prevention
Hotlinking and leeching are third parties embedding or proxying your media to serve their own audiences on your bandwidth. Defences stack:
- Referer allow-listing at the edge for browser playback, with a documented fallback for players that strip it.
- Origin binding and signed tokens so a copied URL is not reusable from another context.
- Rate and concurrency limits per viewer so one session cannot fan out into many.
- User-agent and behavioural rules for automated scraping, applied as signals rather than sole gates.
No single signal is trustworthy on its own; combine them and log the decisions so false positives can be tuned without weakening the policy.
Preventing range-based egress theft
Byte-range requests are essential for seeking, but they are also an egress-theft vector. An attacker can request tiny ranges across a huge catalogue to reconstruct files while defeating naive per-request accounting, or exploit a cache that forwards each range to origin. Controls:
- Ensure the edge serves
206 Partial Contentfrom cache and does not refetch the whole object per range — see Cache control and cache keys. - Normalise, order, and cap the number of ranges per request so a single request cannot walk an entire file.
- Apply per-session byte budgets, not just request counts, so slow-drip scraping is bounded by volume.
- Watch for patterns of many distinct ranges across many objects from one identity.
Keeping auth out of the cache key
This is the most common self-inflicted wound. If a signed token, session ID, or viewer parameter is part of the cache key, every request is unique, the cache becomes a pass-through, and origin egress scales with viewers. Validate entitlement at the edge, then derive the media cache key from the path and genuinely object-defining fields only. Keep authentication out of the key. See Cache control and cache keys for key composition and secure tokens for the validation model.
Purge on takedown
When content must be removed — rights, consent withdrawal, or a lawful order — deletion has to propagate through every layer: origin storage, edge caches, and any derived artifacts such as thumbnails, sprites, and manifests. A hard purge of hot objects can itself cause an origin stampede, so invalidate rather than stampede where the object is still live, and confirm the origin no longer serves the bytes. See Purge, invalidation, and prefetch.
Where AdultInfra fits
AdultInfra keeps origins unreachable from the public internet, binds playback to short-lived signed tokens, and profiles range and session behaviour so egress theft is caught early. Content rights, consent, and takedown obligations remain the customer’s responsibility. Bring one hostname and an origin-egress target to contact us.