Bearer JWT with partial M3U8 [HLS]

[kalwinskidawid]

Question

Hey,

How to pass a JWT by Header to a partial M3U8?
I use Authorization: Bearer MY_JWT as you said in manual.

Request to .../index.m3u8 works well, but the JWT is not propagated to the m3u8 part.

I can add ?jwt=JWT but then Bearer doesn't make sense.

[aler9]

If you are using hls.js, you can configure it in order to insert the JWT inside all outgoing requests:

const hls = new Hls({
	maxLiveSyncPlaybackRate: 1.5,
	xhrSetup: function (xhr, url) {
		xhr.setRequestHeader('Authorization', "Bearer something");
	},
	fetchSetup: function (context, initParams) {
		initParams.headers = {
		...initParams.headers,
		 'Authorization': `Bearer something`
		};
		return new Request(context.url, initParams);
	},
});

[kalwinskidawid]

Thanks @aler9.
I have to check if I can do it in React Native Player.

I have one more question. By default, JWT is valid for 1-3 minutes. I have prepared MediaMTX to use JWKS authorization.
What is the best practice? Should I create a special JWT scope with a longer validity period for HLS (eg. 1h), or simply request a new m3u8 every 1-2 minutes? (Here I have a problem, because when switching from the old to the new m3u8 player, it freezes for a moment, which is not very user-friendly)

[aler9]

I think the best practice consists in generating JWTs that cover then entire period which the user is supposed to watch the stream, because the user might get disconnected and might want to reconnect, furthermore, in the future, users will be automatically kicked out when the JWT expires (#4300).

If your identity server is not capable of generating JWTs with a validity longer than 1-3 minutes, you can install a separate identity server locally and federate it with the original one.

Personally i never use JWTs directly in the UI but i prefer to put a cookie-based gateway in front of users (like Spring Cloud Gateway, passport.js and many others), which internally converts cookies to JWTs or internal credentials or performs some checks. But it's a personal preference.

[kalwinskidawid]

Thanks @aler9, In the future, I will probably switch to Spring Cloud Gateway, but for now, the most convenient solution would be to extend the time to 2-3 hours and refresh it every time a given section of the application is opened. Thank you again for pointing me in the right direction.

So, in general, JWT is most often used between services?