Referrer-based access control

Notice

This document is a machine-translated draft and is currently undergoing review. Some content may be inaccurate or differ from the original Korean version. For the most precise information, refer to the Korean documentation.

• PlanStarterBasicEnterprise

What is a referrer?

The referrer included in the HTTP request header contains the address (URL) information of the web page that immediately preceded the current request. By checking this information in the Kollus VOD console, you can determine whether a content request originated from the customer's official site or from an unauthorized third-party site.

Kollus VOD uses referrer-based access control to block embed code (iframe) theft or abnormal link sharing, and to ensure that content is served reliably only within designated domain environments.

Referrer-based access control policies

Depending on your business security strategy, you can apply one of the following three policies.

Policy	Description
Play only on specific domains	Allows playback only for requests originating from the specified domains, and blocks all other access at the source.
Block only on specific domains	Blocks access only from specific domains suspected of leakage or requiring restriction, while allowing free viewing in all other environments.
Block if no referrer	Treats requests missing referrer information—due to browser security settings, direct link entry, and so on—as abnormal access and blocks them.

---

Referrer settings

You can establish domain security policies on a per-channel basis.

1. Go to [Channel] in the Kollus VOD console.
2. In the channel list on the left of the screen, click [More options] > [Referrer settings] for the target channel.
3. Select the policy that fits your service purpose.
   • [Play only on specific domains]: Enter the domain address to allow, then click [+] to add it to the list.
   • [Block only on specific domains]: Enter the domain address to restrict, then click [+] to add it to the list.
   • [Block if no referrer]: Enable the checkbox to block all requests whose origin information is hidden due to direct address bar entry or security programs.
   Using wildcards (#)

   If registering multiple subdomains individually is cumbersome, you can replace the variable string segment with the # symbol.
   Example: player.a.example.com, player.b.example.com → player.#.example.com

4. After finalizing your review of the domain list, click [Save].