diff --git a/extensions/cronet/src/main/java/com/google/android/exoplayer2/ext/cronet/CronetDataSource.java b/extensions/cronet/src/main/java/com/google/android/exoplayer2/ext/cronet/CronetDataSource.java
index 83f46bd488..e75524c1c9 100644
--- a/extensions/cronet/src/main/java/com/google/android/exoplayer2/ext/cronet/CronetDataSource.java
+++ b/extensions/cronet/src/main/java/com/google/android/exoplayer2/ext/cronet/CronetDataSource.java
@@ -20,6 +20,7 @@ import android.os.ConditionVariable;
 import android.text.TextUtils;
 import android.util.Log;
 import com.google.android.exoplayer2.C;
+import com.google.android.exoplayer2.ExoPlayerFlags;
 import com.google.android.exoplayer2.upstream.DataSourceException;
 import com.google.android.exoplayer2.upstream.DataSpec;
 import com.google.android.exoplayer2.upstream.HttpDataSource;
@@ -206,7 +207,7 @@ public class CronetDataSource extends UrlRequest.Callback implements HttpDataSou
 
   @Override
   public long open(DataSpec dataSpec) throws HttpDataSourceException {
-    Assertions.checkNotNull(dataSpec);
+    Assertions.checkState(!ExoPlayerFlags.REQUIRE_HTTPS || dataSpec.isHttps());
     Assertions.checkState(!opened);
 
     operation.close();
diff --git a/extensions/okhttp/src/main/java/com/google/android/exoplayer2/ext/okhttp/OkHttpDataSource.java b/extensions/okhttp/src/main/java/com/google/android/exoplayer2/ext/okhttp/OkHttpDataSource.java
index 2b6eaa736d..07c607771a 100644
--- a/extensions/okhttp/src/main/java/com/google/android/exoplayer2/ext/okhttp/OkHttpDataSource.java
+++ b/extensions/okhttp/src/main/java/com/google/android/exoplayer2/ext/okhttp/OkHttpDataSource.java
@@ -17,6 +17,7 @@ package com.google.android.exoplayer2.ext.okhttp;
 
 import android.net.Uri;
 import com.google.android.exoplayer2.C;
+import com.google.android.exoplayer2.ExoPlayerFlags;
 import com.google.android.exoplayer2.upstream.DataSourceException;
 import com.google.android.exoplayer2.upstream.DataSpec;
 import com.google.android.exoplayer2.upstream.HttpDataSource;
@@ -145,6 +146,8 @@ public class OkHttpDataSource implements HttpDataSource {
 
   @Override
   public long open(DataSpec dataSpec) throws HttpDataSourceException {
+    Assertions.checkState(!ExoPlayerFlags.REQUIRE_HTTPS || dataSpec.isHttps());
+
     this.dataSpec = dataSpec;
     this.bytesRead = 0;
     this.bytesSkipped = 0;
diff --git a/library/src/main/java/com/google/android/exoplayer2/ExoPlayerFlags.java b/library/src/main/java/com/google/android/exoplayer2/ExoPlayerFlags.java
new file mode 100644
index 0000000000..0af9208d59
--- /dev/null
+++ b/library/src/main/java/com/google/android/exoplayer2/ExoPlayerFlags.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.google.android.exoplayer2;
+
+/**
+ * Global configuration flags. Applications may toggle these flags, but should do so prior to any
+ * other use of the library.
+ */
+public final class ExoPlayerFlags {
+
+  /**
+   * If set, indicates to {@link com.google.android.exoplayer2.upstream.HttpDataSource}
+   * implementations that they should reject non-HTTPS requests.
+   */
+  public static boolean REQUIRE_HTTPS = false;
+
+  private ExoPlayerFlags() {}
+
+}
diff --git a/library/src/main/java/com/google/android/exoplayer2/upstream/DataSpec.java b/library/src/main/java/com/google/android/exoplayer2/upstream/DataSpec.java
index d251446976..ced276d7eb 100644
--- a/library/src/main/java/com/google/android/exoplayer2/upstream/DataSpec.java
+++ b/library/src/main/java/com/google/android/exoplayer2/upstream/DataSpec.java
@@ -167,6 +167,13 @@ public final class DataSpec {
     this.flags = flags;
   }
 
+  /**
+   * Returns whether the instance defines a HTTPS request.
+   */
+  public boolean isHttps() {
+    return uri != null && "https".equalsIgnoreCase(uri.getScheme());
+  }
+
   @Override
   public String toString() {
     return "DataSpec[" + uri + ", " + Arrays.toString(postBody) + ", " + absoluteStreamPosition
diff --git a/library/src/main/java/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java b/library/src/main/java/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java
index b326c41b18..2b3f91c77c 100644
--- a/library/src/main/java/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java
+++ b/library/src/main/java/com/google/android/exoplayer2/upstream/DefaultHttpDataSource.java
@@ -19,6 +19,7 @@ import android.net.Uri;
 import android.text.TextUtils;
 import android.util.Log;
 import com.google.android.exoplayer2.C;
+import com.google.android.exoplayer2.ExoPlayerFlags;
 import com.google.android.exoplayer2.util.Assertions;
 import com.google.android.exoplayer2.util.Predicate;
 import com.google.android.exoplayer2.util.Util;
@@ -186,6 +187,8 @@ public class DefaultHttpDataSource implements HttpDataSource {
 
   @Override
   public long open(DataSpec dataSpec) throws HttpDataSourceException {
+    Assertions.checkState(!ExoPlayerFlags.REQUIRE_HTTPS || dataSpec.isHttps());
+
     this.dataSpec = dataSpec;
     this.bytesRead = 0;
     this.bytesSkipped = 0;