DRM-X 6.0Node.js + Express video DRM integration
Add DRM-X 6.0 protected video to Express with authenticated routes, trusted content mappings, same-origin checks and tested access revocation.
Quy trình cấp quyền phát video
Backend quyết định ai được xem. DRM-X cung cấp thông tin cấp quyền phát. Trình phát dùng thông tin đó để yêu cầu giấy phép DRM.
- Người xem
Đăng nhập vào dịch vụ của bạn và yêu cầu xem video.
- Backend của bạn
Kiểm tra giao dịch mua, gói đăng ký hoặc quyền xem khác của người dùng.
- DRM-X
Áp dụng các quy tắc đã chọn và trả về cấu hình cùng thông tin cấp quyền phát.
- Trình phát
Dùng thông tin cấp quyền nhận được để yêu cầu giấy phép DRM cần thiết cho việc phát video.
Before you begin#
Publish a protected video in DRM-X 6.0 and copy its Content ID. Create server integration credentials with license-tokens:create permission. Keep Site ID, Site Key and Access Key in server configuration; only short-lived playback data reaches the browser.
Serve the learning site over HTTPS. HTTP localhost works only on the same computer; an HTTP LAN address does not provide the secure context required for browser DRM. Test with a supported browser and your actual content.
Install and mount the Express router#
Extract the Node.js + Express source ZIP and keep the express and node folders together. Use Node.js 24 or newer. In express, run pnpm install --frozen-lockfile, then pnpm test. Express 5.1.0 is pinned in this release.
Import createDrmxRouter from express/router.mjs and mount it after your existing session and authentication middleware. Configure publicOrigin, instanceId and server credentials. The identity callback reads your authenticated user, and authorize queries your database on every page and session request.
Download Node.js + Express source
app.use("/drmx", createDrmxRouter({
publicOrigin: "https://learning.example.com",
instanceId: process.env.DRMX_INSTANCE_ID,
credentials: {
siteId: process.env.DRMX_SITE_ID,
siteKey: process.env.DRMX_SITE_KEY,
accessKey: process.env.DRMX_ACCESS_KEY
},
identity: req => req.user?.id,
authorize: (userId, videoId) => yourRepository.authorizedVideo(userId, videoId)
}));Map content and embed the player#
The authorized database record supplies enabled, title, contentId, contentType and policy. Return null for unpaid, expired, disabled or revoked access. Open /drmx/videos/VIDEO_ID after login to display the embedded player. Its POST endpoint is /drmx/videos/VIDEO_ID/session. The browser cannot choose the viewer identity or weaken the saved policy.
Use secure session cookies and the exact configured HTTPS publicOrigin. Session POST requests require JSON and the same Origin, protecting the cookie-authenticated request from cross-site submission. Keep both routes out of shared caches, and do not add permissive CORS. The test-only X-Test-User header in the test suite must never become your production login method.
Verify access changes#
Eight tests pass with real Express HTTP routing, including authentication, origin checks, malformed and oversized input, content binding, server-owned identity/policy, escaped player markup and revocation. The upstream DRM-X responses are simulated. Test your actual login middleware, database rules, deployment proxy and protected playback before rollout.
Integration source downloads · Universal Player Web guide · License policies · DRM for education · Multi-DRM protection