Has anyone tried to protect media assets(with hash) outside Sitecore application? For example, if a request comes for a Sitecore media URL, you need to create a separate application(say a webApi), reference Sitecore kernel and use the same hashing algo that "ProtectMediaUrl" uses...and return the valid hash for the requested media ?
Add a comment
|
1 Answer
You are asking how to get the hash value for a Sitecore media item and specific parameters from a non-Sitecore application, yes? You only need the hash if you are providing querystring parameters to the media asset; note the h and w parameters in this link:
https://yoursite.com/image.jpg?h=165&w=400&hash=64724EFA440F8C6CC25FF0206D2109B34BBF2020
You should be able to create an API as you mentioned that takes in the media reference and parameters you need, then returns the hash for the media item. However, this API would open your site up to the very type of attack that Media Request Protection is designed to prevent. If you go this route, make sure that API is properly secured and protected from malicious users.
If you don't need to use any parameters, you don't need to get the hash; Sitecore will return the unaltered media item.
answered Jun 8, 2018 at 15:18
-
Thanks for reply Ed. I did reference the sitecore kernel dll into this application to call the "protectmedia " method that generates the url with hash. So i got a ringtone error " sitecore configuration was not available " . So i de compiled this method of sitecore and used the hashencryption and hashalgorithm class in the same way the aforesaid method used it to generate the hash (computehash method). The hash value i got when i used the sitecore's shared secret key was different from what it renders in the sitecore web app when i directly call the "ProtectMediaAsset" method. Jun 9, 2018 at 16:21
-