0

I have a problem delivering videos in .NET Core. I'm getting a video file by an absolute path and returning it to be used as a source in a element. However, I'm enabling HTTP Range requests by passing enableRangeProcessing: true to the method, and after fast seeking through the video (once it's loaded) the action stops providing responses. The response contains exactly 16.1kb of data and does not contain any response preview or response content at all.

Reloading the page after that does not help, the only thing that fixes it is rebuild and rerun again, or sometimes if you wait a while (2-3 minutes) the video loads normally on reload.

More often than not it happens when you load a video initially (preferably a longer one, the videos i'm trying to display are actually movies from my PC) and then try to "seek" through the video in quick succession. I'm seeing about 100-150 requests in DevTools (most of them cancelled, but still). After that, the requests stop responding with parts of the movie. Again, this does not happen every time and sometimes the issue disappears after 2-3 minutes.

Here's a link to a video capturing the issue. As described above, about 3 minutes after I stopped recording the video loaded normally.

The action in question

public IActionResult GetVideo(string path) {
    path = Uri.UnescapeDataString(path);
    return PhysicalFile(path, "application/octet-stream", enableRangeProcessing: true);
}

And here's the front-end side

<video src="@Url.Action("GetVideo", "Home", new { path = ViewBag.Id })" controls></video>

The path variable is an URI-escaped string of the absolute path in my system (for debugging purposes, it will be through IDs in the future.

When trying with virtual paths (place a mp4 file in the wwwroot folder), the issue is no longer present but I'd like to be able to deliver the videos from physical paths.

Does anyone know what might be causing this?

Emberfire
  • 89
  • 7
  • You don't need to do this step: "`id.Replace("-", " ").Replace("%amp%", "&");`" - just use URI-encoded values correcty. In JavaScript that's `encodeURIComponent(string)` and in .NET it's `Uri.EscapeDataString(String)`. Also your misuse of JavaScript's `string.replace` is probably the cause of the problem because `string.replace` will only replace the *first* occurrence, not all occurrences (see: https://stackoverflow.com/questions/1144783/how-to-replace-all-occurrences-of-a-string ) – Dai Mar 03 '20 at 07:16
  • @Dai thanks, I will try that, but this was more like a temporary solution, as i'm going to be working with IDs in the future, i threw this together quickly in order to get it working atleast, without a working DB. My problem is more about the request fail after a few attempts, for example changing the source and sending a new request quickly after seeking a different range in the current video. The requests just arrive empty, with 16.1kb of data every time – Emberfire Mar 03 '20 at 07:19
  • I wonder if the problem may be related to you using `application/octet-stream` instead of the actual Content-Type (e.g. `video/mp4`) as different video containers and file-types require completely different approaches for calculating range requests - and if the browser doesn't know what the actual type is (e.g. because the ` – Dai Mar 03 '20 at 07:28
  • Also, what HTTP server or reverse-proxy are you using? (Full-fat IIS? IIS Express? nginx? Kestrel?) - you could be hitting the same-host connection-limit. Chrome/Chromium/Opera/MSEdge2020 is currently limited to 6 simultaneous HTTP connections to the same host: https://stackoverflow.com/questions/985431/max-parallel-http-connections-in-a-browser – Dai Mar 03 '20 at 07:30
  • @Dai Yes, other browsers behave the same. I tried changing the content type to video/mp4 but nothing changed. I tested the problem a bit more and it seems that the problem appears exactly when you change the source too quickly (tried changing the option menu with arrow keys fast), but after a brief period of not changing it, and then changing, the video loads normally (sometimes). I'm using the IIS Express visual studio provides for debugging purposes. – Emberfire Mar 03 '20 at 07:39

1 Answers1

0

For anyone that encounters this problem: The result of this was actually a bug found in ASP.NET Core 3.1 which could allow attackers to DDOS the hosting server. It has been fixed in version 3.1.6.

Emberfire
  • 89
  • 7