quoije/oscars-pool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor: Use query token for API video playback

Browse Source 
Co-authored-by: mathieumoran1 <[email protected]>
This commit is contained in:
Cursor Agent
2025-12-22 07:11:03 +00:00
co-authored by mathieumoran1
parent fd881399cd
commit e91c919b46
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/js/app_player.js
+6 -8
View File
@@ -582,10 +582,10 @@ async function probeApiVideoReadable(rawUrl) {
async function ensurePlayableApiVideoUrl(rawUrl, token) { async function ensurePlayableApiVideoUrl(rawUrl, token) {
if (!isApiVideoUrl(rawUrl) || !token) return rawUrl; if (!isApiVideoUrl(rawUrl) || !token) return rawUrl;
await ensureVideoSessionForSource(rawUrl, token); // IMPORTANT: Prefer query-token auth for media elements.
const ok = await probeApiVideoReadable(rawUrl); // Cookie-based auth is unreliable cross-origin (and even across ports in some setups)
if (ok) return rawUrl; // and causes intermittent 401s + preflight noise. Both Node + Python servers already
// Fallback: servers also accept ?token=... (avoids cookie timing/site issues). // support ?token=... so we use it consistently.
return addTokenToApiVideoUrl(rawUrl, token); return addTokenToApiVideoUrl(rawUrl, token);
} }
@@ -625,7 +625,7 @@ async function playVodLink(vodLink, { token } = {}) {
videoEl.addEventListener('error', () => { videoEl.addEventListener('error', () => {
// If the browser can't play it (or CORS blocks), fall back to iframe. // If the browser can't play it (or CORS blocks), fall back to iframe.
setSourceLabel('Embed (fallback)'); setSourceLabel('Embed (fallback)');
showEmbedPlayer(raw); showEmbedPlayer(playable);
}, { once: true }); }, { once: true });
try { videoEl.load(); } catch (_) {} try { videoEl.load(); } catch (_) {}
return; return;
@@ -782,9 +782,7 @@ window.onload = async function () {
return; return;
} }
// Allow <video> to call protected /api/video/* sources without Authorization headers by using a cookie. // We use ?token=... for /api/video/* playback (more reliable than cookies cross-origin).
// If the source is on a different origin (Python video host), we call THAT host’s /api/video/session.
await ensureVideoSessionForSource(resolved.src, token);
if (resolved.isLegacy) { if (resolved.isLegacy) {
// Legacy source: never embed it in the player. // Legacy source: never embed it in the player.
public/player.html
+2
View File
@@ -3,6 +3,8 @@
<head> <head>
<meta charset="UTF-8" /> <meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />
<!-- IMPORTANT: the player may use ?token=... for cross-origin video streaming -->
<meta name="referrer" content="no-referrer" />
<title>Player</title> <title>Player</title>
<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="./css/app.css" rel="stylesheet"> <link href="./css/app.css" rel="stylesheet">