An e-learning platform has a simple promise to instructors: only paying students see the lessons. The hard part is that videos and PDFs are just files. HRC TECH layers several small defences instead of relying on one.
1. No static file serving
Course files are not placed in a public folder. The only way to reach one is the content controller, which checks that the signed-in student is enrolled in the course before returning anything.
2. Short-lived, hashed content tokens
Each playback request gets a ContentAccessToken tied to one student and one lesson with an expiry time. The database stores only the SHA-256 hash of the token, so a leaked table cannot be replayed.
3. Streaming that behaves like a file server
The controller streams the file with byte-range support so video seeking works, and marks responses as non-cacheable:
Response.Headers.CacheControl = "no-store";
return PhysicalFile(file.PhysicalPath, file.ContentType, enableRangeProcessing: true);4. Watermarks that identify the student
Uploads are queued on a Channel and processed by a BackgroundService so admins are not blocked. Videos are re-encoded with FFmpeg's drawtext filter (libx264, veryfast preset) and PDFs are stamped with PDFsharp. If a copy leaks, it carries the student's identity.
5. Rate limits on the expensive endpoints
Fixed-window rate limiters partition by IP for strict auth, refresh and content-stream policies, so brute force or scraping attempts are throttled.
Limits
Watermarking is a deterrent and an audit trail rather than DRM: a determined person can still screen-record.
Read the full case study: HRC TECH