How to Play Encrypted HTTP Live Streams Offline with AVFoundation for iOS using Swift 4

2. Create an AVPlayerItem with the AVURLAsset so that the player can have playback control.

3. Create the player from the player item.

4. Finally, add the player to the AVPlayerLayer to display the playback.

 

Then to play/pause, we use these obvious commands:

func play() {
   player.play()
}

func pause() {
   player.pause()
}

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:10
#EXT-X-MEDIA-SEQUENCE:0
#EXT-X-PLAYLIST-TYPE:VOD
#EXT-X-KEY:METHOD=AES-128,URI="https://www.example.com/hls.key",IV=0xecd0d06aef664d8226c33816e78efa44 

The video playback will work with the same method as the unencrypted HLS and the player will automatically access the key URL and download it.

To download an HLS asset, we will use an instance of the AVAssetDownloadURLSession, which is a class that supports the creation and execution of asset download tasks.

Because it’s an encrypted HLS, besides downloading the media file, we also need to download and save the encryption key locally. For this task, we will trigger the asset resource loader to access the .m3u8 files manually:

func initialiseDownloadSession() {
	let configuration = URLSessionConfiguration.background(withIdentifier: downloadIdentifier)
      downloadURLSession = AVAssetDownloadURLSession(
   	    configuration: configuration,
          assetDownloadDelegate: self,
          delegateQueue: OperationQueue.main
      )
}

This method forces the download task to call the AVAssetResourceLoader delegate because it cannot handle the fake URL:

func downloadTask(videoUrl: URL) {
	var urlComponents = URLComponents(
			url: videoUrl,
 			resolvingAgainstBaseURL: false
	)!
      urlComponents.scheme = "nothttps"  
      do {
          let asset = try AVURLAsset(url: urlComponents.asURL())
          asset.resourceLoader.setDelegate(self, queue: DispatchQueue(label: "com.example.AssetResourceLoaderDelegateQueue"))
          downloadURLSession
              .makeAssetDownloadTask(
				asset: asset,
			  	assetTitle: "My Video", 
				assetArtworkData: nil,
				options: nil
			 )?.resume()
      } catch { print("Erorr while parsing the URL.") }
}

In the resource loader, we check if the request has the URL we just modified. Then we change the schema back to the correct one and download the file with a URLSession.

Next, we return true to indicate that the delegate will load the requested resource:

func resourceLoader(
        _ resourceLoader: AVAssetResourceLoader,
        shouldWaitForLoadingOfRequestedResource loadingRequest:          AVAssetResourceLoadingRequest
        ) throws -> Bool {
    guard let url = loadingRequest.request.url else { return false }
    if url.scheme == "nothttps" {
           var urlComponents = URLComponents(
             url: url, 
		      resolvingAgainstBaseURL: false
		  )
     		  urlComponents!.scheme = "https"       
         let newUrl = try urlComponents!.asURL()
         downloadHlsFile(videoUrl: newUrl, loadingRequest: loadingRequest)
         return true
   }
	return false
}

The resource loader will be called as many times as the AVPlayer fails to interpret a resource. We are aiming to get inside a playlist variant, which is where the encryption key is located.

 

So, in the first request, we will get the master playlist and replace all the URL schemas for all the playlist variants with fake ones. Next, we will return the modified data in the loading request and then finish loading the request.

 

Now that we have replaced all the schemas with fake ones, when AVFoundation selects the best media stream, the shouldWaitForLoadingOfRequestedResource method from the delegate will be triggered again with one of the URLs from the master playlist.

 

In the second request, we will finally get access to the encryption key URL. Then we will extract the URL from the file and save it temporarily. We will then replace the key URL in the file with a fake one („notkeyhttps”) and respond with the modified data to the loading request.

func downloadHlsFile(videoUrl: URL, loadingRequest: AVAssetResourceLoadingRequest) {
    var request = URLRequest(url: videoUrl)
    request.httpMethod = "GET"
    let session = URLSession(configuration: URLSessionConfiguration.default)
    let task = session.dataTask(with: request) { data, response, _ in
        guard let data = data else { return }
        let strData = String(data: data, encoding: .utf8)!
        let modifiedData: Data!
        if strData.contains("EXT-X-KEY") {
            let start = strData.range(of: "URI=\"")!.upperBound
            let end = strData[start...].range(of: "\"")!.lowerBound
            let keyUrl = strData[start..<end]
            downloadHlsKey(keyUrl: keyUrl)
            let replacedKey = strData.replacingOccurrences(
                of: keyUrl,
                with: "notkeyhttps://example.com/hlsKey"
            )
            modifiedData = replacedKey.data(using: .utf8)
        } else {
            let replacedSchema = strData.replacingOccurrences(of: "https", with: "nothttps")
            modifiedData = replacedSchema.data(using: .utf8)
        }
        
        loadingRequest.contentInformationRequest?.contentType = response?.mimeType
        loadingRequest.contentInformationRequest?.isByteRangeAccessSupported = true
        loadingRequest.contentInformationRequest?.contentLength = response!.expectedContentLength
        loadingRequest.dataRequest?.respond(with: modifiedData)
        loadingRequest.finishLoading()
    }
    task.resume()
}

Now that we have modified the key URL schema, the delegate method shouldWaitForLoadingOfRequestedResource will trigger for a third time. We will detect when this happens and modify the data with the persistent key, which is the key that we saved locally.

Notice that for the previous requests, we used the MIME content type for the loading request; this time we will use AVStreamingKeyDeliveryPersistentContentKeyType as the content type. This will tell AVFoundation that the content contains the encryption key. 

 

So, the final version of shouldWaitForLoadingRequestedResource will look like this:

func resourceLoader(
        _ resourceLoader: AVAssetResourceLoader,
        shouldWaitForLoadingOfRequestedResource loadingRequest:          AVAssetResourceLoadingRequest
        ) throws -> Bool {
    guard let url = loadingRequest.request.url else { return false }
    if url.scheme == "nothttps" {
           var urlComponents = URLComponents(
             url: url, 
		      resolvingAgainstBaseURL: false
		  )
     		  urlComponents!.scheme = "https"       
         let newUrl = try urlComponents!.asURL()
         downloadHlsFile(videoUrl: newUrl, loadingRequest: loadingRequest)
         return true
   }
	return false
} else if url.scheme == "notkeyhttps" {
      let hlsKey = Keychain.getData(key: .hlsKey)
      loadingRequest.contentInformationRequest?.contentType = AVStreamingKeyDeliveryPersistentContentKeyType
        loadingRequest.contentInformationRequest?.isByteRangeAccessSupported = true
      loadingRequest.contentInformationRequest?.contentLength = hlsKey.count
      loadingRequest.dataRequest?.respond(with: hlsKey)
      loadingRequest.finishLoading()
      return true
}

While the AVFoundation is downloading each segment of the media file, we can monitor the progress using the AVAssetDownloadDelegate method. With this method, you can update the download progress in your app: 

func urlSession(_ session: URLSession, assetDownloadTask: AVAssetDownloadTask, didLoad timeRange: CMTimeRange, totalTimeRangesLoaded loadedTimeRanges: [NSValue], timeRangeExpectedToLoad: CMTimeRange) {
	var percentageComplete = 0.0
      for value in loadedTimeRanges {
          let loadedTimeRange = value.timeRangeValue
          percentageComplete += loadedTimeRange.duration.seconds / timeRangeExpectedToLoad.duration.seconds
      }
    	percentageComplete *= 100
      DispatchQueue.main.async { 
		  self.progressView.updateProgress(percentageComplete.toCGFloat) 
	}
}

When the download is finished, the following method will be called:

func urlSession(_ session: URLSession, assetDownloadTask: AVAssetDownloadTask, didFinishDownloadingTo location: URL) {
	OfflineHandler.save(key: .location, data: location.relativePath)
      let storageManager = AVAssetDownloadStorageManager.shared()
      let newPolicy = AVMutableAssetDownloadStorageManagementPolicy()
      newPolicy.expirationDate = Date().addYears(1)!
      newPolicy.priority = .important
      let baseURL = URL(fileURLWithPath: NSHomeDirectory())
      let assetURL = baseURL.appendingPathComponent(location.relativePath)
      storageManager.setStorageManagementPolicy(newPolicy, for: assetURL)
}

In this method, we get the location where the media file was downloaded. You should save this location because we will use it when the device is offline. Also, notice that the storage manager from iOS will delete files that it doesn’t consider to be very important from time to time.

In this case, we will set a policy for the new downloaded file with a duration and a priority level.

func initializePlayer() {
	let assetPath = OfflineHandler.get(.location) as! String
	let baseURL = URL(fileURLWithPath: NSHomeDirectory())
      let assetURL = baseURL.appendingPathComponent(assetPath)
	let videoAsset = AVURLAsset(url: assetURL)
      videoAsset.resourceLoader.setDelegate(self, queue: DispatchQueue(label: "com.example.AssetResourceLoaderDelegateQueue"))
      let playerItem = AVPlayerItem(asset: videoAsset)
      player = AVPlayer(playerItem: playerItem)
      playerLayer = AVPlayerLayer(player: player)
}

To play the media asset offline, we will need to get the location of the file that we downloaded, make a URL from it, and pass it to an AVURLAsset. 

 

The data in the playlist file still has the fake URL schema for the encryption key, so the resource loader will still need to be called to interpret the key and when that happens, we will provide the key we saved locally.

func resourceLoader(
        _ resourceLoader: AVAssetResourceLoader,
        shouldWaitForLoadingOfRequestedResource loadingRequest:          AVAssetResourceLoadingRequest
        ) throws -> Bool {
    guard let url = loadingRequest.request.url else { return false }
    if url.scheme == "notkeyhttps" {
      let hlsKey = Keychain.getData(key: .hlsKey)
      loadingRequest.contentInformationRequest?.contentType = AVStreamingKeyDeliveryPersistentContentKeyType
loadingRequest.contentInformationRequest?.isByteRangeAccessSupported = true
      loadingRequest.contentInformationRequest?.contentLength = hlsKey.count
      loadingRequest.dataRequest?.respond(with: hlsKey)
      loadingRequest.finishLoading()
      return true
	}
	return false
}