Hmm. It looks like the "hack" is to only set the referrer header of the request to be the domain that's whitelisted which can be done with any HTTP client, but

Hmm. It looks like the "hack" is to only set the referrer header of the request to be the domain that's whitelisted which can be done with any HTTP client, but the issue is also 4 years old. I wonder if that's been addressed because the referrer header is really not something you can trust from the client. I wonder if this also means if you use browser extensions that focus on security (such as randomizing your user agent and deleting the referrer header) that those folks wouldn't be able to even watch the videos. Thanks for bringing this to my attention because if domain restriction does indeed still work like this then I don't think I will use Vimeo for that feature alone. Signed URLs with both time and IP address based restrictions would be ideal. I wonder if IP address based restrictions is something Mux has planned.