Node.js + Express video DRM integration

Add DRM-X 6.0 protected video to Express with authenticated routes, trusted content mappings, same-origin checks and tested access revocation.

Markdown 보기 실행 예제Updated 2026-09-21

재생이 승인되는 과정

백엔드가 시청 가능한 사용자를 결정합니다. DRM-X는 재생 승인 정보를 제공하며, 플레이어는 이를 사용해 DRM 라이선스를 요청합니다.

시청자
서비스에 로그인하고 동영상 재생을 요청합니다.
고객 백엔드
사용자의 구매 내역, 구독 상태 또는 기타 시청 권한을 확인합니다.
DRM-X
선택한 재생 규칙을 적용하고 재생 설정과 승인 정보를 반환합니다.
플레이어
반환된 승인 정보를 사용해 재생에 필요한 DRM 라이선스를 요청합니다.

귀하의 백엔드가 접근을 결정합니다. DRM-X는 서명 된 정책을 시행합니다. 암호화 된 미디어 및 DRM 라이센스는 별도의 배송 경로를 따릅니다.

Before you begin#

Publish a protected video in DRM-X 6.0 and copy its Content ID. Create server integration credentials with license-tokens:create permission. Keep Site ID, Site Key and Access Key in server configuration; only short-lived playback data reaches the browser.

Serve the learning site over HTTPS. HTTP localhost works only on the same computer; an HTTP LAN address does not provide the secure context required for browser DRM. Test with a supported browser and your actual content.

Install and mount the Express router#

Extract the Node.js + Express source ZIP and keep the express and node folders together. Use Node.js 24 or newer. In express, run pnpm install --frozen-lockfile, then pnpm test. Express 5.1.0 is pinned in this release.

Import createDrmxRouter from express/router.mjs and mount it after your existing session and authentication middleware. Configure publicOrigin, instanceId and server credentials. The identity callback reads your authenticated user, and authorize queries your database on every page and session request.

Download Node.js + Express source

app.use("/drmx", createDrmxRouter({
  publicOrigin: "https://learning.example.com",
  instanceId: process.env.DRMX_INSTANCE_ID,
  credentials: {
    siteId: process.env.DRMX_SITE_ID,
    siteKey: process.env.DRMX_SITE_KEY,
    accessKey: process.env.DRMX_ACCESS_KEY
  },
  identity: req => req.user?.id,
  authorize: (userId, videoId) => yourRepository.authorizedVideo(userId, videoId)
}));

Map content and embed the player#

The authorized database record supplies enabled, title, contentId, contentType and policy. Return null for unpaid, expired, disabled or revoked access. Open /drmx/videos/VIDEO_ID after login to display the embedded player. Its POST endpoint is /drmx/videos/VIDEO_ID/session. The browser cannot choose the viewer identity or weaken the saved policy.

Use secure session cookies and the exact configured HTTPS publicOrigin. Session POST requests require JSON and the same Origin, protecting the cookie-authenticated request from cross-site submission. Keep both routes out of shared caches, and do not add permissive CORS. The test-only X-Test-User header in the test suite must never become your production login method.

Verify access changes#

Eight tests pass with real Express HTTP routing, including authentication, origin checks, malformed and oversized input, content binding, server-owned identity/policy, escaped player markup and revocation. The upstream DRM-X responses are simulated. Test your actual login middleware, database rules, deployment proxy and protected playback before rollout.

Integration source downloads · Universal Player Web guide · License policies · DRM for education · Multi-DRM protection