Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to tinker with making VLC support video websites that aren't included in the default distribution. When I view the source of the video webpage, I am able to extract something that looks like a http url to the video files (in several different formats, even). But if this is pasted into a browser tab, I get a big nasty Forbidden 403 error.

Obviously this is to deter people snarfing videos directly. But does anyone have any insight as to how they might be accomplishing it? I don't think it's cookie-based, else it would likely work in the same browser that I opened the video webpage in. Does the Flash player send a different http header than my browser, something like that?

I don't need a perfect solution, just someone to point me in the right direction.

share|improve this question
Try grabbing the video with an established video ripper like keepvid and then look at the URL it uses. – Synetech Aug 2 '12 at 15:10

Usually, hot-linking is tracked by the HTTP referer (sic) field. This tells the webserver what URL sent you to the current request. If it's empty, or not from a valid website, then you're hotlinking! It's fairly easy to spoof, though.

share|improve this answer
I'll have to figure out how to spoof it from lua. Coming up with the correct url for the referrer will be easy, but I don't know if VLC's lua lets you manipulate that. Thanks for the answer. – John O Aug 2 '12 at 16:00
I installed the Spoofy extension, and I figured out how to get curl to do that as well. Both got 403s. I'm looking at the view-source of the video's webpage, and I don't see any obvious javascript trickery. – John O Aug 3 '12 at 0:18

As it turns out, it seems that the URLs to the videos were designed to be temporary, with some Apache mod checking that a hashed timestamp was recent enough. I had left the "view source" tab open for several hours.

I've managed to get my lua script working, and can now watch the videos directly in VLC. If anyone has any requests, I could probably whip something up for you.

share|improve this answer
This doesn't even really seem to answer your original question. This answer needs a great deal of work. – Ramhound Aug 3 '12 at 16:00
@Ramhound It could probably be expanded on slightly, but it does answer his question. How does a site block direct access? -> By using temporary URLs and expiring them after a time. While not the only method, it's one of many. – Darth Android Aug 3 '12 at 16:25
Wasn't trying to karma whore... just wanted it listed in case anyone else ever wanted to know. I'll make any suggested edits. – John O Aug 3 '12 at 16:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.