Develop Reference

Preventing user to see video URL in HTML?

I have an web page where users can view videos.
But the problem is when I inspect the page, it shows the video url.
So is there any idea how we can hide video source like youtube and other videos portal ?

There is no way to hide the video URL entirely without resorting to browser plugins. You can obscure it though, but in most cases they won't be worth it.
Using Media Source Extensions you can deliver segments of video data using obscured urls. And the URL won't be immediately visible in the source of the page. This is similar to what Youtube or Netflix does but requires massive engineering work on the backend. This is also the technique used to play MEPG-DASH with e.g. dash.js or shaka-player.
Set it using Javascript, so it's not viewable with view source, it won't help with inspecting though.
If your issue is people copying the stream URL and using it in their own players, then you might look at protecting it with some sort of tokens security. This is supported by almost any CDN out there, and there are plenty of open source systems to do it in most programming languages.
Lastly, if the issue is that you don't want anyone to copy the content, you can apply DRM protection. One of the easiest and straightforward ways to get started with that, might be using Azure Media Services.

Encrypting Src of Iframe

I own a website. There are some movies on the website, which are made by myself. I want to make money from the website by creating paid movies. That means the website visitor need to pay to watch the full movie or to download the movie.
In the website, the movies are played in an Iframe now. My idea is to upload the paid movies into a directory. The directory's name is as complex as a password. Then I will hide the name of the directory so the website visitors cannot download or watch the paid movies without going into my Iframe.
I have already used javascript to prevent right click "Open in new tab" and "Open in new window". I want to know how can I encrypt the Src of the Iframe so that the website visitors will not know anything just by watching the source code.
Please use PHP or CSS or HTML of JAVASCRIPT to solve this problem. Thank you.

Everyone will be able to look up the videos real url using the network inspector / console. The only way to really protect your videos from being watched from unauthorised people would be setting up an appropriate pay wall / authentication scheme.

Encrypted Media is the standard you're looking for.
It will not do what you asked, but is the solution for you.

chrome extension: how to mute all audio from certain tab

I have been searching for something in chrome extension reference to find anything that would allow me to manipulate audio level of a tab. Only option that has come to my mind is make script have it go through all elements in page and either remove them or mute them if possible.
But i feel there has to be a way to reroute all audio streams to nothing, like break them from output which is speakers if using audio api of html5...however no avail either with chrome extension apis or web audio api.
Goal: mute all sounds on page (flash, audio element, etc.)

You cannot do this now, although this will hopefully change in the near-term future.
At the moment, there is nothing in the Chrome APIs, although I did propose a tabaudio API back in February (and am working on a new draft -- as well as an implementation -- right now.)
Can you give me an idea as to what you want this functionality for? (They ask for potential uses when proposing APIs.)
Perhaps the closest that you can do is something similar to what the MuteTab Chrome extension does (written by me, http://www.github.com/jaredsohn/mutetab), which basically scans the page for object, embed, audio, video, and applet tags and hides them from the page. Unfortunately, this misses web audio. Also, instead of muting, it "stops" it by removing it from the page, which could block the video or game associated with the sound. Alternatively, if you just care about HTML5 video or audio or Flash that has an API (such as YouTube), you could could use JavaScript to pause or mute things.

There's now a Chrome extension allowing to mute websites by URL using blacklist/whitelist approach called "Mute Tabs by URL".
It does require you to allow it to read your 'browsing history', but description swears that it doesn't store your URLs anywhere, and event points to a location of source code, so you can verify it for yourself

How to route visitors from China to Youku and others to Youtube?

Is there a standard way of routing IP addresses from certain ranges to a certain link and another range to another link?
I have a large percent of visitors coming from China, but I don't want to make that reason enough to route all traffic to Youku. Oppositely, I don't want to have a broken page element for people in China.
Currently there is a screenshot button that loads up a Javascript popup. Inside the popup is the video that is meant to load. I could run a script to detect the IP address and server the respective link, if there was a way to detect this.
Im wondering if others have solved this issue already, and if so, what method they used.
Thanks!
ps: For those who dont know, Youtube is blocked in China and Youku is one of China's equivalent video streaming sites.

There may be better ways than this, but an possibility would be to let the client load Youtube (or Youku) in an iFrame and then read the contents of it, if you can't get the page or you can catch some error, then you should get Youku.
That does also mean that when Youtube is down for maintenance for example your script would break.
IP routing may be better, but as far as I know there is not a perfect script for it.
You may want to check this: How do you detect a website visitors country

IE warning workaround? Page w/Secure and insecure items

I have a page that is viewed secured with 'https' in the URL, that also contains youtube urls to play video from youtube. Since the youtube URL contains 'http' with no 's' IE is giving an a warning dialog of "This page contains both secure and non-secure Items."
Is there a way I can workaround this in Javascript? Maybe after the page loads generate the youtube player HTML with a function? The url will still have to begin with 'http://'
EDIT: Thanks everyone for the input so far! I know this sounds impossible. I'd be happy if there was some conditional comment or something so I can tell IE to suppress this dialog box. It confuses our customer since most of the world is in IE, FF has much better behavior in that it tells you if you click the broken lock, but not an annoying popoup. This is like a new version of "your program has performed an illegal operation." (user hides from police) I am embedding youtube video onto the page where the src is from youtube. I am using their player, as it is hosted by them. No way out of this that I see.
I guess my fix is to only apply HTTPS to the very sensitive pages (password change, login) and come out of it in all others so youtube videos don't give this popup. I am in PHP and am worried the SESSION will get clobbered if I do this but I guess it is the only way around and will wait to tackle that bear monday.

One thing I've done to work around this problem is to create a page on my SSL site that proxies in the 3rd party resource. That way the client only sees SSL URLs.
For example, you flash player could point to the URL "https://YourSite.com/proxy.aspx?URL=http://www.youtube.com/video.swf". When "proxy.aspx" is called, it would make a new web request to the URL in the query string and return the data to the client.
If you do this you need to validate the proxied URL or use some kind ID so that the URL can not be changed since you are convincing the browser that this content is trusted.

I've worked around this problem on all browsers using the following:
1) Create a thumbnail image of the start of the video with the "Play image" tag on the snapshot and host the image on your own https server. Embed the thumbnail where you want the video to be.
2) When the user clicks on the image invoke a Javascript onclick handler to create a new window with the href of the http embedded youtube video.
function onImgClickHandler() {
//Link to embedded Viddler or Youtube video
var win = window.open("http://www.viddler.com/player/###/", "My Video",
'height=500,width=800,resizable=yes,scrollbars=yes');
win.focus();
}
3) The video will now appear in a popup of the main page.
I usually use videos as tutorials for my site, so having the video in a popup browser window works well because it can be viewed alongside the main content and lets the user follow along with the site. The browsers do not even give a redirect warning that you are invoking an http popup from an https site, so your users will not see any "scary" non-secure item warnings on any browsers.
Hope this helps, I have an example of the above on the landing page of my site: https://drchrono.com/
UPDATE: I made the image preview by taking a screenshot of the playing video.

According to this quite recent YouTube API blog post, embedded YouTube videos already support access via HTTPS. If this is the case, (and I haven't tested it, but equally I have no reason to not believe them), then you should just be able to stick the "s" into your embed URL and it will work just fine.

If there was a way around it would be a security flaw in IE and Microsoft would patch it, so I don't think you're going to get away with mixed content and no warning.
The only alternative is to host the FLVs yourself. There are a number of good SWF based FLV players available.

Having insecure links on a secure web page is an issue that has little workaround. One option is to exclude specific content on your page when a user connects via https. In this way a non-secure page load would display the content and a secure page load would not display the content:
<% if (!Request.IsSecureConnection){ %>
<div>You can't see this if the page is secure<div>
<%} %>
I have used this method with much success... Hope this helps.

I have had this same problem and found a solution.
It works without having to turn of SSL certification.
Step by step guide to fix Google chrome
You can view the fixed page listed below. It has links to YouTube,Flickr and many other websites. It is secure and has been for a few months now. Hope it helps you too.

The mod_rewrite module of the Apache httpd server can be used to embed YouTube videos on SSL secure pages without any errors, as detailed on Adam Mershon's blog.
It involves setting up a rewrite rule to redirect a path within the SSL domain to non-SSL YouTube:
.htaccess
RewriteEngine on
RewriteBase /
RewriteRule ^youtube/(.*)$ http://www.youtube.com/$1 [L]
So that inside your HTML you can embed YouTube link URLs appearing to be from your own domain, such as:
<embed src="https://www.yourdomain.com/youtube/v/mydjFYoD4WS&hl=en_US&fs=1&rel=0&autoplay=1&"
type="application/x-shockwave-flash"
allowscriptaccess="always"
allowfullscreen="true"
width="560"
height="340">
</embed>

Using Javascript to replace the URL does not work. IE7 intercepts the content, and thereafter, the warning.
I tried using (jQuery) $(function() { }); it sortof works. You can click yes/no to the dialog, the content will load nonetheless.

This is a severe problem in my world. It earns my work comments from users like "It's not user-friendly", "It's broken" or "It killed my kitten".
The proxy solution probably is the only pseudo-fix that's gonna roll. Just that it's clearly not a perfect solution either.
I try to navigate this a bit better by running as much of my sites on https as I can. Obviously the youtube case isn't fixed by that.
IE, what a silly hunk of FUD-pushing abominationware. I hope IE9 really is as vastly better as it seems. Just, not supporting XP means, well, it's sort of like it was never released. As the n00biest of users, will unwittingly write-protect the status quo until the XP-powered Chineese Skynet of 2247 finally feeds us the red pill...

Your problem occurs become the main page is grabbed using Https whilst one or more included files ( images, javascript, css etc ) is fetched using http. Fix the http url to be https.