Django protected video

The three places you customize#

1. Configuresettings.py

   Add drmx and configure DRMX, including AUTHORIZE.

2. Authorize

   Your app: drmx_access.py

   Implement authorize(user, video_id) against your existing system.

3. Routeurls.py

   Include drmx.urls; reuse your normal login and CSRF middleware.

1. Install the wheel#

# From the extracted kit root:
python -m pip install packages/python/drmx_django-1.3.0rc13-py3-none-any.whl

Use Python 3.12+ and a supported Django version (5.2–6.0). Add drmx to INSTALLED_APPS. Keep authentication, sessions and CsrfViewMiddleware. No DRM-X migration command is required for a new install; your own app may still need its normal migrations.

2. Configure settings and routes#

# settings.py — keep your existing application settings
DRMX = {
    'SITE_ID': os.environ['DRMX_SITE_ID'],
    'SITE_KEY': os.environ['DRMX_SITE_KEY'],
    'ACCESS_KEY': os.environ['DRMX_ACCESS_KEY'],
    'INSTANCE_ID': 'my-website',
    'POLICY': 'multi-tier-standard',
    'AUTHORIZE': 'myapp.drmx_access.authorize',
}
# urls.py — add to your existing urlpatterns
path('video/', include('drmx.urls'))

Import os in settings and path/include in urls as usual. Replace myapp with your application module.

3. Return the authorized content#

Create myapp/drmx_access.py. The repository call below is illustrative; use your current purchase, membership or enrollment query.

def authorize(user, video_id):
    video = customer_catalog.find_authorized_video(user.id, video_id)
    if video is None:
        return None
    return {'content_id': video.drmx_content_id,
            'content_type': 'vod', 'title': video.title}

For a first local test, allow one existing test user and one website video ID, then return your published Content ID. Keep that temporary allow rule confined to your local test. The shipped examples/sdk/django/authorization.py denies everyone until you implement it.

In production use the database query on every call. Return None when access is missing, expired or revoked. Omitted policy uses your configured default.

4. Sign in and open the player#

Open /video/lesson-123/ using your own selected website video ID. String IDs and UUIDs work. The SDK supplies the player page and session endpoint and rechecks the callback for each request.

Keep normal Django protections#

Keep the supplied CSRF validation and same-origin endpoint. The current player passes a masked CSRF token in the endpoint URL; exclude its query string from access logs and keep no-store/no-referrer behavior. Use HTTPS and secure session cookies.

Upgrading an older installation with DRM-X tables? Preserve its migration history and read legacy/README.md before removing the old app. The new SDK does not delete those tables.

Check before going live#

• Sign in as an allowed user and play a published video in a supported browser.
• Try signed-out and unpaid users, then revoke or expire access. New session requests must be denied.
• Change the browser Content ID or website video ID. The server must check the new selection.
• Set the exact public HTTPS origin, keep your framework’s session/CSRF protection, and disable demo identity code.

Existing sessions and DRM licenses have their own lifetimes. Permission changes are checked on new requests; they do not erase a license already issued.