segmented_content_protection

Property Manager name: Segmented Media Protection
Behavior version: The v2025-01-13 rule format supports the segmented_content_protection behavior v2.1.
Rule format status: GA, stable
Access: Read/Write
Allowed in includes: Yes

Validates authorization tokens at the edge server to prevent unauthorized link sharing.

Option	Type	Description	Requires
`enabled`	boolean	Enables the segmented content protection behavior.		{"displayType":"boolean","tag":"input","type":"checkbox"}
`key`	object array	Specifies the encryption key to use as a shared secret to validate tokens.		{"displayType":"object array","tag":"input","todo":true} {"if":{"attribute":"enabled","op":"eq","value":true}}
`use_advanced`	boolean	Allows you to specify advanced `transition_key` and `salt` options.		{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"enabled","op":"eq","value":true}}
`transition_key`	object array	An alternate encryption key to match along with the `key` field, allowing you to rotate keys with no down time.	`use_advanced` is `true`	{"displayType":"object array","tag":"input","todo":true} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`salt`	object array	Specifies a salt as input into the token for added security. This value needs to match the salt used in the token generation code.	`use_advanced` is `true`	{"displayType":"object array","tag":"input","todo":true} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`header_for_salt`	string array	This allows you to include additional salt properties specific to each end user to strengthen the relationship between the session token and playback session. This specifies the set of request headers whose values generate the salt value, typically `User-Agent`, `X-Playback-Session-Id`, and `Origin`. Any specified header needs to appear in the player's request.	`use_advanced` is `true`	{"displayType":"string array","tag":"input","todo":true} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`session_id`	boolean	Enabling this option carries the `session_id` value from the access token over to the session token, for use in tracking and counting unique playback sessions.	`use_advanced` is `true`	{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`data_payload`	boolean	Enabling this option carries the `data/payload` field from the access token over to the session token, allowing access to opaque data for log analysis for a URL protected by a session token.	`use_advanced` is `true`	{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`ip`	boolean	Enabling this restricts content access to a specific IP address, only appropriate if it does not change during the playback session.	`use_advanced` is `true`	{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`acl`	boolean	Enabling this option carries the `ACL` field from the access token over to the session token, to limit the requesting client's access to the specific URL or path set in the `ACL` field. Playback may fail if the base path of the master playlist (and variant playlist, plus segments) varies from that of the `ACL` field.	`use_advanced` is `true`	{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"useAdvanced","op":"eq","value":true}}
`enable_token_in_uri`	boolean	When enabled, passes tokens in HLS variant manifest URLs and HLS segment URLs, as an alternative to cookies.		{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"enabled","op":"eq","value":true}}
`hls_master_manifest_files`	string array	Specifies the set of filenames that form HLS master manifest URLs. You can use `*` wildcard character that matches zero or more characters. Make sure to specify master manifest filenames uniquely, to distinguish them from variant manifest files.	`enable_token_in_uri` is `true`	{"displayType":"string array","tag":"input","todo":true} {"if":{"attribute":"enableTokenInURI","op":"eq","value":true}}
`enable_token_in_query_string`	boolean	When enabled, in the DASH media encryption variant, passes tokens in query strings, as an alternative to cookies.		{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"attribute":"enabled","op":"eq","value":true}}
`token_revocation_enabled`	boolean	Enable this to deny requests from playback URLs that contain a `TokenAuth` token that uses specific token identifiers.		{"displayType":"boolean","tag":"input","type":"checkbox"} {"if":{"op":"and","params":[{"attribute":"enabled","op":"eq","value":true},{"attribute":"modulesOnContract","op":"contains","scope":"global","value":"AccessRevocation"}]}}
`revoked_list_id`	string	Identifies the `TokenAuth` tokens to block from accessing your content.	`token_revocation_enabled` is `true`	{"displayType":"string","tag":"input","type":"text"} {"if":{"attribute":"tokenRevocationEnabled","op":"eq","value":true}}
`hls_media_encryption`	boolean	Enables HLS Segment Encryption.		{"displayType":"boolean","tag":"input","type":"checkbox"}
`dash_media_encryption`	boolean	Whether to enable DASH Media Encryption.		{"displayType":"boolean","tag":"input","type":"checkbox"}

Updated about 1 month ago