On 17.04.2012 14:29, James Robertson wrote:
We have an acl that blocks certain websites, specifically youtube. A website used by staff for work has started publishing training videos on youtube and embeds them in their webpages and we need to allow access to these without allowing access to all of youtube. Is it possible to somehow allow these particular videos from youtube, perhaps based on the site that is linking to them? Or by some other method?
No. Normally you would allow Referer: header containing a trusted site to go through and cross your fingers that nobody abuses that loophole in security to insert Referer: headers to unwanted content.
Youtube videos unfortunately are accessed via redirects from the embeded "watch=FOO" URI to a different video location URI. So even that Referer: trick does not work. You have to find out the actual URLs for each video and permit them individually. Or grab them and host locally.
Amos
