# Django protected video

Use Django authentication, admin-managed video mappings and time-limited access grants with the Universal Player.

再生が許可されるまでの流れ

視聴できるユーザーは、お客様のバックエンドが判断します。DRM-X は再生の認可情報を返し、プレーヤーはその情報を使って DRM ライセンスをリクエストします。

- 01**視聴者**

お客様のサービスにログインし、動画の再生をリクエストします。

- 02**お客様のバックエンド**

購入履歴、サブスクリプション、その他の視聴権限を確認します。

- 03**DRM-X**

選択した再生ルールを適用し、再生設定と認可情報を返します。

- 04**プレーヤー**

受け取った認可情報を使い、再生に必要な DRM ライセンスをリクエストします。

バックエンドはアクセスを決定します。DRM-Xは署名されたポリシーを強制します。暗号化されたメディアとDRMのライセンスは、別の配送パスに従います。

## Install the Django app[#](#install)



Install the django directory from the source bundle into your application environment. Add drmx to INSTALLED_APPS, include drmx.urls, enable Django session and authentication middleware, and run migrations. Keep CsrfViewMiddleware enabled.



```
pip install ./django
python manage.py migrate
# urls.py
path("protected/", include("drmx.urls"))
```



[Download third-party integration source](https://drm-x6-cdn.1aicloud.com/drmx-frameworks-1.3.0-preview.2-f4ee10f26cdf.zip)





## Configure credentials and content[#](#configure)



Define settings.DRMX using SITE_ID, SITE_KEY, ACCESS_KEY, INSTANCE_ID and optional POLICY. Load secrets from your host environment. INSTANCE_ID is a stable site identifier used to separate playback subjects across applications.



In Django admin, open Protected videos and add a record. The DRM-X 6.0 Universal Player section groups Content ID, content type, protection policy and enabled state, with help for each field. Create an AccessGrant for the authenticated user, including start time and optional expiry. An enabled video alone does not grant access; revoking the grant or disabling the video prevents new playback requests.



Open /protected/VIDEO_ID/ after signing in. The page requests a session from /protected/VIDEO_ID/session/. For an existing course or subscription model, replace can_play with your server-side rule and retain the checks for active users, enabled videos and the exact requested video.





## CSRF and deployment[#](#csrf)



The released Web Component does not support custom session headers. This app places a masked Django CSRF token in the same-origin endpoint URL and explicitly validates it with Django’s normal cookie and origin checks. Do not remove that validation or enable shared caching for player pages.



Keep query strings out of access logs, use HTTPS and secure session cookies, and keep the supplied no-referrer behavior. Six tests cover access lifecycle, CSRF, origin, content binding and server-owned identity/policy on Django 6.0.8. Actual DRM playback still requires your published content.

<!-- Canonical: https://docs.drm-x.com/ja/integrations/django -->
<!-- Language: ja -->