ASP.NET Core Universal Player integration

The three places you customize#

1. ConfigureProgram.cs: AddDrmXPlayback

   Set server credentials, application ID and protection policy.

2. AuthorizeQuickStartCatalog.FindAuthorizedVideoAsync

   Query your own database and return QuickStartVideo or null.

3. Authenticate

   Your normal ASP.NET Core middleware

   Supply a stable NameIdentifier claim and protect the mapped endpoints.

1. Run the packaged example#

cd examples/sdk/aspnet-core
# Set DRMX_PLAYBACK_SITE_ID, DRMX_PLAYBACK_SITE_KEY and DRMX_PLAYBACK_ACCESS_KEY.
# For localhost only, set DRMX_LOCAL_DEMO=1.
dotnet run

Use .NET 10. The project references Haihaisoft.DrmX.AspNetCore and its NuGet.Config points to the bundled package. In Program.cs, replace your-published-content-id inside QuickStartCatalog.FindAuthorizedVideoAsync. Open http://127.0.0.1:8105/?videoId=1.

2. Connect the customer lookup#

Replace the demo catalog implementation with an authorized query. This illustrative repository belongs to your application:

var video = await repository.FindAuthorizedVideoAsync(
    userId, videoId, cancellationToken);
if (video is null) return null;
return new QuickStartVideo(video.DrmxContentId, video.Title);

The supplied QuickStartEntitlement : IDrmXContentEntitlement reuses this lookup and compares the requested Content ID and type. Keep that comparison. The catalog is request-scoped; do not change a singleton Content ID for each user.

3. Connect normal authentication#

Replace local-demo identity middleware with your existing authentication. Keep a stable NameIdentifier claim and protect the page and MapDrmXPlaybackSession() endpoint with your authorization policy, for example .RequireAuthorization(). Configure your real HTTPS host and retain same-origin request checks.

4. Add the player to your lesson page#

Reuse the example’s script tags and Web Component. Its session URL includes ?videoId=... so both the page and session request resolve the same selected lesson. The current example configures policy application-wide in AddDrmXPlayback; Content ID is resolved per request.

Check before going live#

• Sign in as an allowed user and play a published video in a supported browser.
• Try signed-out and unpaid users, then revoke or expire access. New session requests must be denied.
• Change the browser Content ID or website video ID. The server must check the new selection.
• Set the exact public HTTPS origin, keep your framework’s session/CSRF protection, and disable demo identity code.

Existing sessions and DRM licenses have their own lifetimes. Permission changes are checked on new requests; they do not erase a license already issued.