Password-Protected Video plays in Firefox but needs a poke in Safari

[jerrykrinock]

Note: A duplicate question was answered "No" over a year ago by DavidG of cPanel, but I have some new information.

Here's what I did…

• Using cPanel's File Manager, create a new directory on a remote server.
• In cPanel, password-protect the new directory, composing a Username and Password.
• Using the FTP client on my computer, upload a .mov Quicktime movie file to this new directory.
• On my computer running Mac OS X, activate Safari 7.0 and browse to the uploaded .mov file. A sheet appears asking for Username and password.
• Enter the Username and password. Another sheet appears asking for Username and Password, this time in a freestanding dialog window. (Maybe this is coming from the plugin now, per DavidG.)
• Enter the User name and password again.

RESULT: A Quicktime Player appears, but showing the scrubber and control strip only, no video box. It says "Loading", and hangs there forever.

• On same Macintosh, activate Firefox Aurora 27.0a2 (Firefox "alpha") and browse to the same .mov file. Again, sheet appears asking for Username and password.
• Enter the Username and password. Once.

RESULT: Movie plays!

I've tried this with 3 movies, same result.

But wait, there's more.

I then composed this post, in Safari, providing a /http://sheepsystems.com/engineering/protected/test/test.mov link to the demo movie up on my site, in case anyone wants to try it for themselves. When I previewed the post, I clicked on the link, and, amazingly, the movie played, without even asking for authentication this time!

Here is the authentication credentials:

Username: test
Password: test13579

It seems like maybe we're very close to making this work. Any additional data or ideas would be appreciated.

Why I want this: I support some Mac OS X apps, and sometimes people send me their private data in a support request. I'd like to be able to make a quick video, showing them what to do with their data, and then create a protected folder for them on my server, upload the video, and send them the username and password. I know there are alternative services which can do this, but to do it on my own cPanel site is quick, convenient for both of us, and of course, no additional cost or accounts to fuss with.

Jerry Krinock

 

[jerrykrinock]

In my original post, it looks like the raw URL appeared instead of a link to my test movie. Let me try it again.

/http://sheepsystems.com/engineering/protected/test/test.mov

This should be a link to the test movie.

Again,

Username = test
Password = test13579

And, this morning, it WORKS in Safari, as expected, as it does in Firefox, only asking for my credential once.

The "loading forever" problem which I experienced yesterday was also reported by someone I sent a link to a real movie to. Does the explanation by DavidG of cPanel apply to this issue, or is something else going on?

 

[cPanelMichael]

Hello

That response does appear to apply to this issue. You may want to consult with the support for the specific playback application you are using for the video, consider offering the video file as a download, or use an alternate method of streaming the video.

Thank you.

 

[jerrykrinock]

Thank you, Michael. So that I can reproduce the issue to further study the playback application, I need to understand why, it seems, once I've logged in to the protected page with Firefox, it will subsequently play in Safari.

I suspect that cPanel whitelists my IP address after I have successfully logged in (with Firefox), so that subsequent page loads (with Safari) are allowed without authentication? Is that the way it works?

If so, is there a way to remove addresses from that whitelist (or whatever it is) in cPanel? I don't seem to have any way to change my I.P. address for repeat testing. The old trick of leaving the ISP's modem off for several minutes does not seem to work with my Comcast Xfinity service. I left if off for 20 minutes but still got the same I.P. address.

Thanks again,

Jerry

 

[jerrykrinock]

Further testing indicates that the magic is not correlated with I.P. address. It is still a mystery.

 

[jerrykrinock]

Now submitted to Apple Bug Reporter. Problem ID 15469180.

 

[cPanelMichael]

Yes, the authentication is not granted to your IP address after logging in. There is a good answer on how HTTP Authentication works at:

HTTP authentication logout via PHP - Stack Overflow

Thank you.

 

[jerrykrinock]

I have a workaround for this bug in Safari. It works if I embed the video into a professionally-crafted HTML page.