XonaPlayXonaPlay
View MarkdownOpen in ClaudeOpen in ChatGPT

Security

Each workspace picks a level in Settings → Security. A single video can override it (for example, an Open trailer in a Strict course).

No level stops screen recording. Nothing does — not even DRM. The levels stop the cheap ways to steal a video: copying a link, scraping playlists, sharing a URL on a forum.

At a glance

Level Link expires Bound to
Open Never —
Protected (default) Video length + 1 h —
Strict 10 min to start, then length + 30 min The viewer's network
Maximum Same as Strict The viewer's exact IP

Open

  • Who gets a link: anyone.
  • Old /hls/v/… links: keep working.
  • Stops: nothing.

Protected (default)

  • Who gets a link: anyone, for public videos; a key or a session for private ones.
  • Segments: signed per link.
  • Stops: links pasted elsewhere working forever, and lazy scrapers.
  • Does not stop: sharing a link while it is valid, yt-dlp, screen recording.
  • Can break: a pause longer than the link. The player recovers on its own.

Strict

  • Who gets a link: only your backend (secret key) or a signed-in user.
  • Bound to: the network of whoever opens it first (/24 on IPv4, /64 on IPv6). One network change is allowed (Wi‑Fi ↔ 4G).
  • Stops: passing a link to someone else.
  • Does not stop: yt-dlp inside the session, a relay, screen recording.
  • Can break: casting from another network, rotating VPNs, iCloud Private Relay, two network changes. Reload fixes it.

Maximum

  • Who gets a link: same as Strict.
  • Segments: served through our proxy, bound to the viewer's exact IP.
  • Stops: downloading segments from another machine.
  • Does not stop: a relay on the viewer's own machine, screen recording.
  • Can break: any network change (Wi‑Fi ↔ 4G). Reload fixes it.

Maximum is enabled per workspace by the XonaPlay team, because every byte goes through our servers.

Allowed domains

On every level, allowed domains decide which sites can embed our player iframe. They also filter keyless /playback calls made from a browser (the Origin header). Native apps send no Origin, so they are not affected.

Settings → Security → Revoke all links kills every link already handed out, on every level except Open. Playlists stop working at once; segments that were already downloaded keep playing until the player asks for the next one. Changing the level does the same.

Bring your own server

Videos stored on your own engine ("only on my servers") are validated by that engine with the same links and the same rules.