Has anyone tried to protect media assets(with hash) outside Sitecore application? For example, if a request comes for a Sitecore media URL, you need to create a separate application(say a webApi), reference Sitecore kernel and use the same hashing algo that "ProtectMediaUrl" uses...and return the valid hash for the requested media ?

1 Answer 1


You are asking how to get the hash value for a Sitecore media item and specific parameters from a non-Sitecore application, yes? You only need the hash if you are providing querystring parameters to the media asset; note the h and w parameters in this link:


You should be able to create an API as you mentioned that takes in the media reference and parameters you need, then returns the hash for the media item. However, this API would open your site up to the very type of attack that Media Request Protection is designed to prevent. If you go this route, make sure that API is properly secured and protected from malicious users.

If you don't need to use any parameters, you don't need to get the hash; Sitecore will return the unaltered media item.

  • Thanks for reply Ed. I did reference the sitecore kernel dll into this application to call the "protectmedia " method that generates the url with hash. So i got a ringtone error " sitecore configuration was not available " . So i de compiled this method of sitecore and used the hashencryption and hashalgorithm class in the same way the aforesaid method used it to generate the hash (computehash method). The hash value i got when i used the sitecore's shared secret key was different from what it renders in the sitecore web app when i directly call the "ProtectMediaAsset" method. Jun 9, 2018 at 16:21
  • . I wonder why the difference Jun 9, 2018 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.