Ok, I know that serving media files through Django is a not recommended. However, I’m in a situation where I’d like to serve “static” files using fine-grained access control through Django models.
Example: I want to serve my movie library to myself over the web. I’m often travelling and I’d like to be able to view any of my movies wherever I am, provided I have internet access. So I rip my DVDs, upload them to my server and build this simple Django application coupled with some embeddable video player.
To avoid any legal repercussions, I’d like to ensure that only logged-on users with the proper permissions (i.e. myself and people living in the same household, which can, like me, access the real DVDs at their convenience), but denies it to other users (i.e. people who posted comments on my blog) and returns an HTTP 404.
Now, serving these files directly using Apache and mod_wsgi is rather troublesome because when an HTTP request for the media files (i.e. http://video.mywebsite.com/my-favorite-movie/) comes in, I need to validate against my user database that the person at the other end has the proper permissions.
Question: can I achieve this effect without serving the media files directly through a Django view? What are my options?
One thing I did think of is to write a simple script that takes a session ID and a video’s slug and returns some boolean indicating if the user may (or may not) access the video file. Then, somehow request mod_wsgi to execute this script before accessing the requested URL and return an HTTP 404 if the script failed. However, I don’t have a clue if this is even possible.
Edit: Posting this question clarified some of my ideas for search and I’ve come across mod_python‘s file wrapper extension. Does anyone have enough experience with that to validate that it is a viable solution?
Yes, you can hook into Django’s authentication from Apache. See this how-to: