Node.js + Express video DRM integration

Add DRM-X 6.0 protected video to Express with authenticated routes, trusted content mappings, same-origin checks and tested access revocation.

Markdown を表示動作サンプルUpdated 2026-09-21

再生が許可されるまでの流れ

視聴できるユーザーは、お客様のバックエンドが判断します。DRM-X は再生の認可情報を返し、プレーヤーはその情報を使って DRM ライセンスをリクエストします。

視聴者
お客様のサービスにログインし、動画の再生をリクエストします。
お客様のバックエンド
購入履歴、サブスクリプション、その他の視聴権限を確認します。
DRM-X
選択した再生ルールを適用し、再生設定と認可情報を返します。
プレーヤー
受け取った認可情報を使い、再生に必要な DRM ライセンスをリクエストします。

バックエンドはアクセスを決定します。DRM-Xは署名されたポリシーを強制します。暗号化されたメディアとDRMのライセンスは、別の配送パスに従います。

Before you begin#

Publish a protected video in DRM-X 6.0 and copy its Content ID. Create server integration credentials with license-tokens:create permission. Keep Site ID, Site Key and Access Key in server configuration; only short-lived playback data reaches the browser.

Serve the learning site over HTTPS. HTTP localhost works only on the same computer; an HTTP LAN address does not provide the secure context required for browser DRM. Test with a supported browser and your actual content.

Install and mount the Express router#

Extract the Node.js + Express source ZIP and keep the express and node folders together. Use Node.js 24 or newer. In express, run pnpm install --frozen-lockfile, then pnpm test. Express 5.1.0 is pinned in this release.

Import createDrmxRouter from express/router.mjs and mount it after your existing session and authentication middleware. Configure publicOrigin, instanceId and server credentials. The identity callback reads your authenticated user, and authorize queries your database on every page and session request.

Download Node.js + Express source

app.use("/drmx", createDrmxRouter({
  publicOrigin: "https://learning.example.com",
  instanceId: process.env.DRMX_INSTANCE_ID,
  credentials: {
    siteId: process.env.DRMX_SITE_ID,
    siteKey: process.env.DRMX_SITE_KEY,
    accessKey: process.env.DRMX_ACCESS_KEY
  },
  identity: req => req.user?.id,
  authorize: (userId, videoId) => yourRepository.authorizedVideo(userId, videoId)
}));

Map content and embed the player#

The authorized database record supplies enabled, title, contentId, contentType and policy. Return null for unpaid, expired, disabled or revoked access. Open /drmx/videos/VIDEO_ID after login to display the embedded player. Its POST endpoint is /drmx/videos/VIDEO_ID/session. The browser cannot choose the viewer identity or weaken the saved policy.

Use secure session cookies and the exact configured HTTPS publicOrigin. Session POST requests require JSON and the same Origin, protecting the cookie-authenticated request from cross-site submission. Keep both routes out of shared caches, and do not add permissive CORS. The test-only X-Test-User header in the test suite must never become your production login method.

Verify access changes#

Eight tests pass with real Express HTTP routing, including authentication, origin checks, malformed and oversized input, content binding, server-owned identity/policy, escaped player markup and revocation. The upstream DRM-X responses are simulated. Test your actual login middleware, database rules, deployment proxy and protected playback before rollout.

Integration source downloads · Universal Player Web guide · License policies · DRM for education · Multi-DRM protection