Question

In my Silverlight applicatin, I am using Basic Authentication to communicate with my WCF Web Services. Everything works great, until my MediaElement attempts to request a video of a secure URL resource. I get the authentication dialog.

Ideally, I would like to include the UID/PWD in the Authorization header of the MediaElement’s request, but I do not know how to do this.

If this is not possible, how else can I restrict the access of the media element to only my application for the user logged in?

Answer 1

We solved this with a workaround…

When we authenticate the user with our webservices, we add a server side HTTP only cookie for the session.

var creds = string.Format("{0}:{1}", user.Username, user.Password);
var bcreds = System.Text.Encoding.UTF8.GetBytes(creds);
var base64Creds = Convert.ToBase64String(bcreds);

HttpCookie httpCookie = new HttpCookie("Authorization", "Basic " + base64Creds);
httpCookie.HttpOnly = true;
HttpContext.Current.Response.Cookies.Add(httpCookie);

Then we created a custom HttpModule to validate this cookie for access to the media files. In the custom handler we can make sure that the IP address of the request matches the session and that the request is actually coming from our Silverlight application.