<p>What is the best way to password protect quicktime streaming videos using php/.htaccess. They are being streamed using rtsp, but I can use other formats if necessary.</p>

<p>I know how to do authentication with php, but I'm not sure how to setup authentication so that will protect the streaming files urls so that a user can't just copy the url and share it.</p>

<p>Or am I overthinking this and I can just use a normal authentication scheme and place the files in a protected directory?</p>

First off, it is very easy to spoof a referer. This information is stored in the user's browser, so a user can simply telnet into your server and provide his own referer which matches your domain.
A couple things you could try:
First, more secure, but still spoofable. mod_rewrite provides the ability to check cookies. What you could do is set a cookie when the user visits your website that contains some obscure data. Then, you could modify your RerwriteCond to something like this:
```
```
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_COOKIE} obscurename=obscurevalue [NC]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]
RewriteRule \.(asx¦ASX)$ http://www.yourdomain.com/images/leech.gif [R,L]
```
```
Another, better technique would involve working with PHP and mime-types. I'm not sure to what extent this would support streaming content, but I assume it'll work. What you can do is have all your video links point to a .php file (the query string will determine which video has been selected). Then, when a user tries to visit this link, you do something like so:
```
```
<?php
    // You could also check some sort of session variable
    // that is set when the user visits another part of your
    // site
    if(!isLoggedIn()){
       header("Location: errorPage.htm");
       exit;
    }else{
       // Get the name of the file specified
       $file = get_file_name($_GET['fileID']);

       // Specify the proper mime-type for the data you're sending
       // (this may have to change, depending on your situation)
       header("Content-type: video/vnd.rn-realvideo");

       // Read the file and output it to the browser
       readfile($file);
    }
?>
```
```
From what I read, most servers know which mime-types are streaming mime-types, so the browser should be able to figure out how to handle the streaming file properly.