From 58a10d5b554941f1eec91c10104811e00c3f5f43 Mon Sep 17 00:00:00 2001 From: 4gray Date: Sun, 2 Aug 2026 10:08:37 +0200 Subject: [PATCH] docs(playback): state the exact override release points MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex round-5 P2 flagged that the media 'ended' event does not clear the scoped override while the player stays mounted. That is deliberate, not a gap: a mounted player still owns the session — replay or a seek into an unbuffered range must keep working against a gated stream, and clearing on 'ended' would 403 exactly the streams this PR fixes. The credentials only ever travel to the exact origin that issued them, and every dismount path (channel/source change, player close/destroy, radio close, playerless selection) releases them. The security doc and the release note now say precisely that instead of the ambiguous "cleared when playback ends". Co-Authored-By: Claude Fable 5 --- .changes/playback-stalker-stream-credentials.md | 7 ++++--- docs/architecture/electron-security.md | 9 +++++++-- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/.changes/playback-stalker-stream-credentials.md b/.changes/playback-stalker-stream-credentials.md index 85159ebd5..2519cb4cc 100644 --- a/.changes/playback-stalker-stream-credentials.md +++ b/.changes/playback-stalker-stream-credentials.md @@ -7,6 +7,7 @@ issues: [849, 910, 732] Stalker portal streams that require the portal session now play in the built-in players (HTML5, Video.js, ArtPlayer), not only in VLC/MPV: the player's own requests carry the portal cookie and token, scoped to that -stream and cleared when playback ends. VOD, series and radio streams get the -same portal headers live TV already had, including on same-host streaming -ports. +stream and dropped when the player closes or the channel changes. VOD, +series and radio streams get the same portal headers live TV already had, +including on same-host streaming ports and when opened from Favorites or +Recently Viewed. diff --git a/docs/architecture/electron-security.md b/docs/architecture/electron-security.md index 7a46a78c1..060bdcc0c 100644 --- a/docs/architecture/electron-security.md +++ b/docs/architecture/electron-security.md @@ -171,8 +171,13 @@ deliberately stricter than the general scope: also cover, and never to third-party hosts an HLS manifest may point at - they live only in the in-memory override: never in the session cookie jar, never on disk, so they cannot outlive the app process -- they are dropped whenever the scoped override is replaced (channel change) - or cleared (playback end, `WebPlayerViewComponent` destroy) +- they are dropped whenever the scoped override is replaced (channel or + source change) or released — player close/destroy, a radio host's close, or + a new selection that mounts no player surface. The media `ended` event + deliberately does **not** clear the override: the mounted player still owns + the session (replay, or a seek into an unbuffered range, must keep working + against a gated stream), and the credentials only ever travel to the exact + origin that issued them; every dismount path above releases them The header-injection design was chosen over `session.cookies.set()` deliberately: jar cookies only attach to credentialed requests, which would