From ea37bf95efa3ff6f804597181173b011a5e7f62e Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 22 Dec 2025 05:35:50 +0000
Subject: [PATCH] Refactor video session handling and CORS configuration

Co-authored-by: mathieumoran1 <mathieumoran1@gmail.com>
---
 public/js/app_player.js                       |  65 +++++++++++++++---
 .../__pycache__/server.cpython-312.pyc        | Bin 10541 -> 11653 bytes
 python_video_server/server.py                 |  30 +++++++-
 3 files changed, 84 insertions(+), 11 deletions(-)

diff --git a/public/js/app_player.js b/public/js/app_player.js
index b20f86e..27542b1 100644
--- a/public/js/app_player.js
+++ b/public/js/app_player.js
@@ -352,6 +352,58 @@ function setOpenOriginal(raw) {
   }
 }
 
+function isApiVideoUrl(raw) {
+  const s = String(raw || '').trim();
+  if (!s) return false;
+  if (s.startsWith('/api/video/')) return true;
+  try {
+    const u = new URL(s);
+    return u.pathname.startsWith('/api/video/');
+  } catch (_) {
+    return false;
+  }
+}
+
+function toVideoSessionUrl(videoSrc) {
+  const s = String(videoSrc || '').trim();
+  if (!s) return null;
+  if (s.startsWith('/')) return '/api/video/session';
+  try {
+    const u = new URL(s);
+    return new URL('/api/video/session', u.origin).toString();
+  } catch (_) {
+    return null;
+  }
+}
+
+async function ensureVideoSessionForSource(videoSrc, token) {
+  // Only needed for our protected /api/video/* streams.
+  if (!token) return;
+  if (!isApiVideoUrl(videoSrc)) return;
+  const sessionUrl = toVideoSessionUrl(videoSrc);
+  if (!sessionUrl) return;
+
+  // If sessionUrl is cross-origin, we need credentials so the cookie is stored for that domain.
+  const isCrossOrigin = (() => {
+    try {
+      const u = new URL(sessionUrl, window.location.origin);
+      return u.origin !== window.location.origin;
+    } catch (_) {
+      return false;
+    }
+  })();
+
+  try {
+    await fetch(sessionUrl, {
+      method: 'POST',
+      headers: token ? { 'Authorization': `Bearer ${token}` } : undefined,
+      ...(isCrossOrigin ? { credentials: 'include' } : {}),
+    });
+  } catch (_) {
+    // best-effort
+  }
+}
+
 async function playVodLink(vodLink) {
   const raw = normalizeVodLink(vodLink);
   if (!raw) {
@@ -520,15 +572,6 @@ window.onload = async function () {
 
     setHeader(movie);
 
-    // Allow <video> to call /api/video/* without Authorization headers by using a cookie.
-    // Best-effort: if it fails, external video_src URLs can still work.
-    try {
-      await fetch('/api/video/session', {
-        method: 'POST',
-        headers: token ? { 'Authorization': `Bearer ${token}` } : undefined,
-      });
-    } catch (_) {}
-
     const resolved = resolveMovieSource(movie);
     if (!resolved?.src) {
       setOpenOriginal(null);
@@ -538,6 +581,10 @@ window.onload = async function () {
       return;
     }
 
+    // Allow <video> to call protected /api/video/* sources without Authorization headers by using a cookie.
+    // If the source is on a different origin (Python video host), we call THAT host’s /api/video/session.
+    await ensureVideoSessionForSource(resolved.src, token);
+
     if (resolved.isLegacy) {
       // Legacy source: never embed it in the player.
       setOpenOriginal(resolved.src);
diff --git a/python_video_server/__pycache__/server.cpython-312.pyc b/python_video_server/__pycache__/server.cpython-312.pyc
index 2e00b6c1a8b36f59af2c1f90e037d7b3528c68d8..1eb5ce224174b4df2465417df476651a222dd8df 100644
GIT binary patch
delta 3372
zcmZt|YfPKh^}BxK0DfR&$2@F;2^hkAfixt|gOG#;!UkE=d5c`f_X1A*>itXt5eU|0
zYky=K^r~yN?vZF!)hXG+#-D1_rc_h3M4MV3QsRE<p3<c4$5fi`Ppe7WIoFsV)=%=e
z=XK9L_ndRj@lS`p@s-lwmy}o)_+HPQjQ=gLQ0mn^XIN->Wt=Efp+yOAa%XsF(iiqg
z+M1|HR)#A9KTLP9Dq0M`5>_>8qNUf2;cA`2s;TWZL3@f4_DkBnNe6&7NuC2>6;c<E
zidz*v3w2)Ip(wOW>?2jA4_UL}T95~&wu`!N>+&`?ZPiIhIrS7I;oa2BidfZ7P?SCy
z=+0|~a6R=&9~(vuv;yc5tz@PRc@@x&v>N1o76e`qv$7xyj_Sb1tb&H%VgXQUqDN>A
zY}*BDweSNaP`9u>lu$CNmzq{u2O(&tyP0d7BPLo8Hd<(dbfgs=2?5;(7Ai+|v=Q)j
zxQyd={)S4p1Fz<!O?1!Z-8xz4#kg41xhe|*IHr7CiRs4RcfM9pW|V2=;wAA;MTMDM
zcS#&$xS+dUX8@HMCEP_xxEl=bV_gLkRJqikC~Da@ZVPgGG3%l-1ayz24P$7dHQdcQ
zE~*=zZdsUzb+K;RM)!;n{M~84ZGsr$M-<pHu|;<Sr5y!FzyT*EcRCC7D50N&DDGwM
zr;&tAbX_xU#;6BuPJM>WZn}>?Gp4(<A44b4-)?+64Jqh>#NdHX>*qkBl144`;Fe<#
z!m%@-aqP1N*Xf~a%BGXHLsKNCBQgP3l+aOeM*l54(Mo%VhDQeDlqT4fC|~-sem^m}
zz$kYMzp>XC0MsGIjJGP>XZw%!4Mlo~hEDbOMMjPc_KozP>C^NB(Me%8y?3k%G&N%)
zeT8w&s%E1+t6qs`$3r^agc3cEUQzMg1OnWTjFLzu%2gJ*z@nUS-T}NS;WM8gHA@%F
z1H@hd3|@%<E%P?<8%xmB38+R?&5%m-q^buhfcC^EmP+G6pn}3zG)-#6Yejc0xHqKd
z&x+I5a=$#XEHXC1R5cPyr?M=Sjbx`Xj2{EF4)JwsD;&IJy-7&3I8$8PEDvo38E*ri
z8P!Z8p4Ig66o6zr6|(R?6dp&=F5W2a^vWZOH*UqFsWHaSfV5kDSp3jYgGLOQXm*?r
z<Cc-7hb4OnIVJvE>e+Q#3OS2XO`l+B`%9>kS48Zr*k@}fmj_rQqwxfb#Iq2yD98qu
zF57;IPPaSC>wKszJ;!ir#V<@SK7}4dlWNGwFQB+dBpfXTTVo8OkiNuH{1V8%EEXM^
z9q1}&0AfU}SY1npoC!j9i92QfAaYe~sGB*w%y@isYQx55kTCIK*`G*8yz8pzN&*cT
zfR>=}5(H%cexh)B!bTA!)2Xp^B$kLnLO4F6jHq+h&!URv#M+D;85kHk7a1DvKhb}B
zL?ey7A5EPCa8=jRcqU}jN}>s<yGWYH$Kokfb8aOgoQ<(b&5`HDIHPb-Jep7oyOJzB
zo~E1RIAnowqKYrLJ;W`>-FwI*@v8gR&TJ{1D8EUf!aJfyL3}QeF%^+AIU{CF(<W-V
zOt_AkC2o<uN=J)Q7LZsss2wRnjWcFiJZ*ek`GJm>(9$eEIQdDAZQ3kX`<QXYGHp<e
zusd(dF>Sf%Dd;|3sRLeoNYdb!^CFIbZQrz|&=jU2t4^1fmK^{U>Y64IOpW}el#pBe
zqr9@W8ORXP3~F?g@kS){P?^z5&7@{|JeI}xmty>zAmJ|q&<v-MehE?2h*S}FPsmy{
z5>2uZsMUkwxTm4FRK9YKWuoaPcmmAD##xeS=6uvuE(^E_<+g2&CSTUA;ya$k*%T;*
ziul)H;V&Y<4kJqzEV9@H2a7BfOH)QQiwZ8N;DT0Cz#`FXmTSeabox@9;p@n%DxL|g
zB>&|blnaU_nq`s8amvyW6&go8o#Nk96ti+2wAKHJChzdk5A6O`d&AAWk8Q0hw$?RU
z`(s=8imiLi_RQSLoY}VQX<IS3<;uJ-TXNOA-`c%e-L`Q2-o6KutG(xbKDm7U!rY*k
z@%sGMviZUJL(7)hoW;4m!{jo}4SZx*ET!|_8)sJ?wc;&rC-kQeymLm96z8j}Oj!TC
zS<F@cfqY*K`YTKr6h1Ff{^0Z2Jv3{Q(Rei9<K}^J)pTJh%hUk>JSuhp_~*L-;C;%S
zZz31<Le;Vt$SiUEGo}^wO~zOzi?^4rcuG9+2b*Q8wl!&N!90k2%$%v|1at@Np4=;X
z10ixuBm<r%?1|igz=<FVAmrjdL|i6R=JH2KGI2LhS^i@{wW869L;_L;?ei{*j*Gtr
z0w>X3jqt6F5;!Wpra~&WuKBbULkY8JGM`rdE6{y&slVoD`g%EQ(0M+I06S2A2Ucey
zJARe_7FZvP>bjl)3PXhF-$`6i>`Le`Ka4xP2=<Aoy5rD8?$x#XJfl&VhM9OvvM^*>
zODxS*ZWsTm^UQ8WLNjNkWHXdqGC%nOXlxe(?4g=Ic7^iWNJ=*c5qkx}0s`6c4Hwes
z1ebZh!6qjVe*-ZLbUw4cKnx!t^xIi98_i@i2TVn-7J6s|rZpcx6`Uq8tG5a@Z=U@B
zHp{<?+NDuSBTsJ&V=oOchlc}sgg``idIF{wMxOgx5Mo@R-H^1LEp0ODpIQzi({v)i
zp5>1~OyH+l^y0nUP5M8=y#93eY{~mh-*QFAV&9r`|C~)s)&G6=Ba`B;TCQqe>|Aqo
zFDs5*aPQ+_&q}c8?cTNE;Yaq<H(t1R<aa0DIdQ*#-tn4e!Sm|QRr~3=l3ay<S@FKF
zH_gqg>D@ORt9sve)td*`{OyZhT=jRoeei)}rRUTGb+u=B9ggtK4d(o{%ZAFoDEh~W
zb479H49=X>Uzzi?=E{A!vhw*l3D!##Quc4fOmyom@qB|fR8H(S>(>=n7N3*LgYo5a
u;fKj5$og2X=mP6Hz}7p&t%jF&e)42OuQ-N?S`4?puXCTQH{AC+0sar$Pe@__

delta 2347
zcmZ7$Yiv_h_})J5y1rQVUR$=VEv)Sx1?Q0PN?;-c!3X@nRONctbGqHq_Lg(+UStN)
z5sX3<jv9=T;LinAbpK2=n)pM+5E6)y8)7t(AO0H}6JuiH_nodoca!^_?|r`Wy-q*>
z(ZS%2K)@@(xABL)`j+VVV5cMHJfFJoLb)^7DN95mjis(~I2Q(d6Y<gr@xkw>k%B@3
z^X^>KA<-xaUXjs<B<0o$dd&*m4YVS7O#mZE6?gEj{o(Z_blfLNq#0pd{feXJrcM`k
zqUwoUFWAL}mlo2xS}B(xZM2a_y1-UM<|6I$u3VCIh)CBJT%;4|^`wg`%knVLeIx?%
zD2)TJk$P#I#tRPgfj_)%E$F1kW2Bpw719H0G5C9hx`(ETOyq)7sCr2p5|JSZ+PW$b
zg(SgAKUpUN8Gu0613d^Ah6@hT2lx;?Ds-jxXepPa*`mge^|b6v)iVI{W+Gor*Xe>x
zGH_2nZF_hZ1UoSAUh%RKyioL#A0$I0JMOr;p`NnU-d58P)kcUFZ+Mu}N9xHfc*yX7
z?iq%Abi60>XgxYIGB2&fF)}NsH}iSdxy6Kgv#hkhD_JYolu>sNpiO*1`H&YHZay9b
z%66BGY07M`X=%(dr*&&0?O-XCIGHwWVqe5!tQ#2twW=|bs$*1Rl(8)EB7DZPM~*Fi
z<=HPcg@M5$2+%Vd<WX-@-oSTy+v38$UDZw1)CyE(w4_=36jcj)iLx!A9p^LNIXTAv
z^nS7(U8J3CD;%~vZ_QSzEvu#z$XGp;7Il1*nx>jJDi*C+Dk`y^ps|7f;>$unA^&Ar
z&hXCy37-gN0Avu+&w&o#E<{HW3~@(rxKqUDUw#|YD&v$r3(^sOAb33#1I%_+HEV)B
zjV8}5_N^I_<-PpHrjGcNLdd8_Y-fp9(jImYb!v);9pdjcrP{>>Uh!5{w;*#zK(=r3
zPSfWY;+xIwK5XY&(z5(obE~2vo#Nj$57mvwDLm3RN-JyvWQTdMrK-eGYix18<+LpK
za&KEtatt^oZiJPJO;M&7W|vJ(kmUJ+wx8rOA87C0R0J9l9fyMj5Htf=kXQ_H5p_T<
z8<lZG&6jjYGn)cIg}>U~7e$rh%~`FgXQy;RjjRdf(2Yu3hF06vF(5z1jgBue#69PJ
zU%KQV3Td!{U?V=k@sP%G_shzhi-qQtVhH;=>#g@QEInTl8+X+=r_?p(<e~>{I{e!}
zhXm$iRjgAqn3d8&zOO6l&j68@Z5K8jU+78){D-tMJp@JAzF(W+_qtLZpXg&|a(_6i
zh&nX#J>krWqiEW|rr}^S2yiACCfHU?nxACUZlIOCK`62PdBZrWQ*0s2G#fw%8Wq1<
z5?k}oA{JFeqSWO?vDZKiy_;77oRog`cU>I3?N6QDea{toYaRDRcJMbM;gF~OM^E#T
zPia+7?tc)JJVE|VWEdL!ugFQaT;#L8Yn8p=fMxgxz2D2Pb3GnWFm`r|zaCG%gbitX
z%arI^ZAeZ5<G3<5Yf&@C_MqZ0fZuKcfL0KeZzC7=(%quln28L`uHCqMCQqvt6uQ<h
zQ#_bR4vMs`ntmK=mOz^ZMopsxjW~#`4z4EBqd2OzQl{2~L2MV%^A=l!QXD+igdl_f
z2PNIg&LS=<A&PJg$uWK-5p6#YsNGnYER`VnFr$}HG|K-;#9HtHw#@!FjT@3{m&e_-
zpeE&7N!S9Yo?WELkDYyDePP&a5<v`sn1qH2s+FvX<Lpyl-Q`<STVp7Mey=r|4x3d<
zZ(`fgq65JQe<$^XT;=yt8&8A^8Z6kVJ_Na_8Wre)hp)67s<UFs#Q4<~C@yN&ivWky
zcIKxEdk;ww+CIcyL6AkMYs@f8VvC9uSWDss6l4CdgsQ|YBPt4sLu@;>Y8CdH0eQei
zv>PEfl^K(;o-i9sloX%3Di42qwv`PsS)x1GmmrnlHxD~_G1Jd4W=`;A|NYS=MRK^$
zbe`(G<?X&L_uM@~Zk3PSIl>-DA-U;t-x40zo)gEn6SofMu9tsD)*nvE5nFNqwv^)c
K2hO-f^8W?N4kU2^

diff --git a/python_video_server/server.py b/python_video_server/server.py
index f6410b2..f384f1e 100644
--- a/python_video_server/server.py
+++ b/python_video_server/server.py
@@ -9,6 +9,7 @@ from urllib.parse import quote
 import jwt
 from bson import ObjectId
 from fastapi import FastAPI, Header, HTTPException, Request, Response
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, StreamingResponse
 from pymongo import MongoClient
 
@@ -22,6 +23,7 @@ JWT_SECRET = _env_str("JWT_SECRET")
 MONGO_URI = _env_str("MONGO_URI")
 VIDEO_FILES_DIR = Path(_env_str("VIDEO_FILES_DIR", str(Path.cwd() / "public" / "video"))).resolve()
 COOKIE_MAX_AGE_SECONDS = int(_env_str("VIDEO_SESSION_MAX_AGE_SECONDS", "28800"))  # 8h
+COOKIE_SAMESITE = _env_str("VIDEO_COOKIE_SAMESITE", "Lax")  # Lax|Strict|None
 
 
 def _parse_bearer(authorization: Optional[str]) -> str:
@@ -115,6 +117,25 @@ def _mongo_client() -> MongoClient:
 
 app = FastAPI()
 
+# CORS: needed so the app can call the Python host's /api/video/session
+_cors_origins_raw = _env_str("CORS_ALLOW_ORIGINS", "*")
+_cors_origins = [o.strip() for o in _cors_origins_raw.split(",") if o.strip()]
+_cors_allow_origin_regex = None
+if len(_cors_origins) == 0 or (len(_cors_origins) == 1 and _cors_origins[0] == "*"):
+    # With credentials, browsers can't accept Access-Control-Allow-Origin: *
+    # Using a regex makes Starlette reflect the requesting Origin instead.
+    _cors_origins = []
+    _cors_allow_origin_regex = ".*"
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=_cors_origins,
+    allow_origin_regex=_cors_allow_origin_regex,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
 
 @app.post("/api/video/session")
 def create_video_session(request: Request, response: Response, authorization: Optional[str] = Header(default=None)):
@@ -123,14 +144,19 @@ def create_video_session(request: Request, response: Response, authorization: Op
 
     secure = request.url.scheme == "https" or (request.headers.get("x-forwarded-proto") == "https")
     encoded = quote(token, safe="")
+    samesite = (COOKIE_SAMESITE or "Lax").strip().lower()
+    if samesite not in ("lax", "strict", "none"):
+        samesite = "lax"
+    samesite_attr = "None" if samesite == "none" else ("Strict" if samesite == "strict" else "Lax")
     cookie_parts = [
         f"video_auth={encoded}",
         "Path=/api/video",
         f"Max-Age={COOKIE_MAX_AGE_SECONDS}",
-        "SameSite=Lax",
+        f"SameSite={samesite_attr}",
         "HttpOnly",
     ]
-    if secure:
+    # Modern browsers require Secure when SameSite=None
+    if secure or samesite == "none":
         cookie_parts.append("Secure")
     response.headers["Set-Cookie"] = "; ".join(cookie_parts)
     response.status_code = 204