# oss-video

Part of **OSS**

<!-- intent-backlink:auto -->

> 💡 **Path Selection**: This skill is one implementation path for [Process media files (e.g., HLS streaming)](../../intent/oss-process-files/SKILL.md). If you're unsure which path to take, check the routing skill first.

# Object Storage Service Streaming Console Guide

## Operations Overview

| Operation | Console Entry Path | Prerequisites | Description |
|----------|-------------------|---------------|-------------|
| Create HLS Stream | Console > OSS > Buckets > [Bucket Name] > Security Settings > CORS Configuration / Anti-Hotlink Protection | A bucket must be created before setting up HLS streams | Configure CORS and anti-hotlink settings to enable secure HLS streaming from OSS |

## Operation Steps

### Create HLS Stream

**Navigation**: Console > OSS > Buckets > [Bucket Name] > Security Settings > CORS Configuration / Anti-Hotlink Protection

**Prerequisites**:
- A bucket must be created before setting up HLS streams

1. Click the bucket name in the bucket list  
   - Element: **[Bucket Name]** (link) — left-side navigation pane  
   - Notes: Replace [Bucket Name] with your actual bucket

2. Navigate to CORS settings  
   - Element: **CORS Configuration** (menu) — left-side navigation pane under Sensitive Data Protection  

3. Click the Create CORS Rule button  
   - Element: **Create CORS Rule** (button) — top of the CORS panel  

4. Configure CORS parameters such as origin and allowed methods  
   - Element: **CORS Rule** (text_input) — CORS Rule panel  
   - Notes: Set Origin to full URL including protocol and port, e.g., http://192.168.xx.xx:8080

5. Navigate to Anti-Hotlink Protection settings  
   - Element: **Anti-Hotlink Protection** (menu) — left-side navigation pane under Sensitive Data Protection  

6. Turn on hotlink protection  
   - Element: **Enable Anti-Hotlink Protection** (toggle) — Anti-Hotlink Protection page  

7. Enter trusted domains or IP addresses in Referer whitelist  
   - Element: **Referer Whitelist** (text_input) — Anti-Hotlink Protection page  
   - Notes: Use wildcards like *.aliyun.com for domain patterns

8. Select 'Do not allow empty referer' option  
   - Element: **Allow Empty Referer** (radio) — Anti-Hotlink Protection page  
   - Notes: Must configure whitelist to have effect

9. Click Save to apply changes  
   - Element: **Save** (button) — bottom of the page  

| Parameter | Type | Required | Options/Values | Description |
|-----------|------|----------|----------------|-------------|
| Origin | text_input | Yes | — | The domain or IP address that is allowed to access the bucket via CORS |
| Allowed Methods | dropdown | Yes | GET, PUT, POST, DELETE, HEAD | HTTP methods permitted by the CORS rule |
| Referer Whitelist | text_input | No | — | List of trusted domains or IP addresses allowed to access media files |
| Allow Empty Referer | radio | Yes | Yes, No | Whether requests without a Referer header are allowed |

## FAQ

Q: Where do I find CORS and anti-hotlink settings in the OSS console?  
A: After selecting your bucket, look under "Sensitive Data Protection" in the left-side navigation pane for both **CORS Configuration** and **Anti-Hotlink Protection**.

Q: What should I enter in the Origin field for CORS when testing locally?  
A: Enter the full URL of your local development server including protocol and port, such as `http://192.168.1.100:8080` or `http://localhost:3000`.

Q: Can I modify CORS or hotlink settings after creating an HLS stream?  
A: Yes, you can return to the same configuration pages at any time to update or delete existing rules.

Q: Why is it necessary to disable "Allow Empty Referer"?  
A: Disabling empty referer ensures that only requests with a valid Referer header matching your whitelist can access media files, preventing unauthorized embedding.

Q: Do these settings automatically enable HLS streaming?  
A: These security configurations are prerequisites for secure HLS playback. You still need to set up RTMP ingest and generate proper PlayURLs separately.

## Pricing & Billing

### Billing Model
HLS stream media playback requests are billed per request.

### Price Reference
| Tier | Input Price | Output Price | Other Costs |
|------|-------------|--------------|-------------|
| standard | 0.0001 / | 0.0001 / | Storage fees charged based on actual usage |

### Free Tier
Monthly free quota of 1000 requests.

### Billing Notes
HLS streaming playback requests are charged per invocation. Note that signed URLs used for private buckets have expiration times, and retries may incur additional charges.