Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for encrypted videoplayback requests #29

Open
Fijxu opened this issue Dec 21, 2024 · 2 comments · May be fixed by #65
Open

Support for encrypted videoplayback requests #29

Fijxu opened this issue Dec 21, 2024 · 2 comments · May be fixed by #65
Labels
enhancement New feature or request

Comments

@Fijxu
Copy link
Contributor

Fijxu commented Dec 21, 2024

Title. The query parameters that are included on /videoplayback requests contain sensitive data like the IP from where the video was requested and the potoken used for it. It would be ideal to encrypt the query parameters to prevent bad actors from using the requests and to get that type of data.

@unixfox unixfox added the enhancement New feature or request label Dec 24, 2024
@unixfox unixfox moved this to Future in Invidious companion Dec 25, 2024
@Fijxu
Copy link
Contributor Author

Fijxu commented Mar 16, 2025

Done in https://git.nadeko.net/Fijxu/invidious-companion/commit/7eae31613e6d674dc5122a980e0ac6cc2d57ae2b, https://git.nadeko.net/Fijxu/invidious/commit/facd01b52e6b7122fb3413345fef2d5d08b1f377 and https://git.nadeko.net/Fijxu/http3-ytproxy/commit/6bd0f28d779596c2f7439395818db0c46698d5f0

There is only one problem tho. If the user uses unproxied HD720 quality on Invidious, they will be able to get the IP from where the video stream was gathered. I think the only way to prevent that data from leaking out is just to force proxy the videoplayback trough the server. let me know what do you think.

@unixfox
Copy link
Member

unixfox commented Mar 16, 2025

If the user uses unproxied HD720 quality on Invidious, they will be able to get the IP from where the video stream was gathered.

You could fix that by having latest_version always returning a proxied URL.


The issue with the implementation is that this forces the usage of the builtin videoplayback proxy and you can't use other like piped-proxy.

But if that is configurable and not by default, why not. Could you create a PR in order to review the change?

@Fijxu Fijxu linked a pull request Mar 18, 2025 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
Status: Future
Development

Successfully merging a pull request may close this issue.

2 participants