Node.js + Express video DRM integration

Add DRM-X 6.0 protected video to Express with authenticated routes, trusted content mappings, same-origin checks and tested access revocation.

Voir le Markdown Exemples en ligneUpdated 2026-09-21

Comment la lecture est autorisée

Votre backend décide qui peut regarder le contenu. DRM-X fournit l’autorisation de lecture. Le lecteur l’utilise pour demander une licence DRM.

Spectateur
Se connecte à votre service et demande une vidéo.
Votre backend
Vérifie l’achat, l’abonnement ou toute autre autorisation d’accès de l’utilisateur.
DRM-X
Applique les règles choisies et renvoie la configuration ainsi que l’autorisation de lecture.
Lecteur
Utilise l’autorisation reçue pour demander la licence DRM nécessaire à la lecture.

Votre moteur décide de l'accès; DRM-X applique la politique signée. Les licences de médias chiffrés et DRM suivent des chemins de livraison séparés.

Before you begin#

Publish a protected video in DRM-X 6.0 and copy its Content ID. Create server integration credentials with license-tokens:create permission. Keep Site ID, Site Key and Access Key in server configuration; only short-lived playback data reaches the browser.

Serve the learning site over HTTPS. HTTP localhost works only on the same computer; an HTTP LAN address does not provide the secure context required for browser DRM. Test with a supported browser and your actual content.

Install and mount the Express router#

Extract the Node.js + Express source ZIP and keep the express and node folders together. Use Node.js 24 or newer. In express, run pnpm install --frozen-lockfile, then pnpm test. Express 5.1.0 is pinned in this release.

Import createDrmxRouter from express/router.mjs and mount it after your existing session and authentication middleware. Configure publicOrigin, instanceId and server credentials. The identity callback reads your authenticated user, and authorize queries your database on every page and session request.

Download Node.js + Express source

app.use("/drmx", createDrmxRouter({
  publicOrigin: "https://learning.example.com",
  instanceId: process.env.DRMX_INSTANCE_ID,
  credentials: {
    siteId: process.env.DRMX_SITE_ID,
    siteKey: process.env.DRMX_SITE_KEY,
    accessKey: process.env.DRMX_ACCESS_KEY
  },
  identity: req => req.user?.id,
  authorize: (userId, videoId) => yourRepository.authorizedVideo(userId, videoId)
}));

Map content and embed the player#

The authorized database record supplies enabled, title, contentId, contentType and policy. Return null for unpaid, expired, disabled or revoked access. Open /drmx/videos/VIDEO_ID after login to display the embedded player. Its POST endpoint is /drmx/videos/VIDEO_ID/session. The browser cannot choose the viewer identity or weaken the saved policy.

Use secure session cookies and the exact configured HTTPS publicOrigin. Session POST requests require JSON and the same Origin, protecting the cookie-authenticated request from cross-site submission. Keep both routes out of shared caches, and do not add permissive CORS. The test-only X-Test-User header in the test suite must never become your production login method.

Verify access changes#

Eight tests pass with real Express HTTP routing, including authentication, origin checks, malformed and oversized input, content binding, server-owned identity/policy, escaped player markup and revocation. The upstream DRM-X responses are simulated. Test your actual login middleware, database rules, deployment proxy and protected playback before rollout.

Integration source downloads · Universal Player Web guide · License policies · DRM for education · Multi-DRM protection