Trigger withCredentials for initial .mpd file (CloudFront Signed Cookies)

[tony]

Greetings! Firstly, thank you very much for this project!

I am trying to switch from CloudFront Signed URLs to CloudFront Signed Cookies (more info on signed cookies)

Before: Signed URLs (works!)

Currently, I facilitate signed URLs by passing the .mpd file URL withthe signed params, then:

const credentials = url.split('?')[1]

dashPlayer.extend(
  'RequestModifier',
  () => {
    return {
      modifyRequestURL: (url: string) => {
        if (!url.includes(credentials)) {
          return `${url}?${credentials}`
        }
        return url
      },
    }
  },
  true,
)

This works great

How to do signed cookies?

My intuition is this:

dashPlayer.extend(
  'RequestModifier',
  () => {
    return {
      modifyRequestHeader: (xhr: XMLHttpRequest) => {
        xhr.withCredentials = true
        return xhr
      },
    }
  },
  true,
)

However, withCredentials only works for subsequent requests, not the .mpd one.

Based on my research, this came up here: #2324 (comment) via @epiclabsDASH:

@herrsiim, two alternative approaches commonly used that avoids you to extend the client:

• Include the token in the mpd when defining media (chunks) urls. This implies returning a different mpd to each user that is not always possible.
• Use a query string token for mpd request. Use a cookie based token for the next ones.

It's been a few years/releases since then, is there a way to make it so the mpd request (the initial one that fetches the .mpd file) uses withCredentials: true with CloudFront signed cookies? Any workarounds? For me it'd be much more efficient to avoid signing twice.

[dsilhavy]

Hi @tony , does this work for you:

player.setXHRWithCredentialsForType('MPD', true);

[tony]

Preliminary feedback:

Looks like it does something. Before trying 'MPD', player.setXHRWithCredentialsForType() has no effect.

The reason why is adding that makes the video's not work, whereas before, the URL signing method worked [1]. I'm not around the CORS issues yet.

[1] This is odd, seeing as url signing is supposed to be have precedence over cookies