AJAX: JWT auth for video load via src

Question

I am requesting a video from an API that requires JWT web tokens:

    // when the ajax call is done (the tolken is recieved )
    getAccessToken.done(function(data) {


        var d = JSON.stringify({'fpath': fpath})
        // get the download url
        var downloadurl = $.ajax({
            type: "POST",
            url: "https://gcp.inbcu.com/download",
            beforeSend: function(xhr){
                xhr.setRequestHeader("Authorization", "JWT " +  data.access_token);
            },
            contentType: 'application/json',
            data: d,
            success: function(response){
                $('#video-source').attr('src', response.url)
                $('#myvideo').load()
            },
            error:function(jqXHR, textStatus, errorThrown) {
                console.log("request for download url failed: ", textStatus, errorThrown, jqXHR);
            },
            dataType: 'json'
        });

This ajax call itself is successful (200) and returns the proper values. Mainly it returns a url to set the source of the video.

Problem is, the video src attempts to access the url and doesn't have permission (no jwt token/ authorization). How am I supposed to load the video with the proper permission when loading the src of a video? Is this possible?

score 1 · Accepted Answer · edited May 23 '17 at 12:08

1

As the answer to a similar question explains, this isn't possible. Either you need to do it as an AJAX request, which you previously did, but which was slow, or, you need to add additional methods for the server to accept authentication.

Regarding these auth options, you could add a session cookie that the server can check, or append the token to the video url, like response.url + '?token=' + token.

edited May 23 '17 at 12:08

Community

1
1

answered Jun 15 '16 at 15:41

bigblind

12,539
14
68
123

1

I know this is an old post but please read [this post](https://flask-jwt-extended.readthedocs.io/en/stable/tokens_in_query_string/#:~:text=If%20you%20perform%20a%20GET,ideal%20from%20a%20security%20standpoint.) before using it. Adding JWT to URL isn't good because the browser will save the url with the JWT in the history which can be a security issue. – johannb75 Jul 11 '20 at 05:43

score 0 · Answer 2 · answered Jul 03 '16 at 21:19

0

A service worker would be capitabel of adding the auth token. But that only solves the problem for FF & Blink

answered Jul 03 '16 at 21:19

Endless

34,080
13
108
131

AJAX: JWT auth for video load via src

2 Answers2

Linked