feat: secure hls streams

dev/nginx.conf

@@ -59,16 +59,5 @@ http {
       rtmp_stat all;
       rtmp_stat_format json;
     }
-
-    location /hls {
-      alias /dev/shm/hls;
-      add_header Cache-Control no-cache;
-      add_header Access-Control-Allow-Origin *;
-
-      types {
-        application/vnd.apple.mpegurl m3u8;
-        video/mp2t ts;
-      }
-    }
   }
 }

next.config.mjs

@@ -1,3 +1,4 @@
+const LIVE_SERVER_URL = process.env.NODE_ENV === 'production' ? 'https://backend.hctv.srizan.dev' : 'http://localhost:8888'
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   images: {
@@ -11,7 +12,7 @@ const nextConfig = {
     ]
   },
   env: {
-    LIVE_SERVER_URL: process.env.NODE_ENV === 'production' ? 'https://backend.hctv.srizan.dev' : 'http://localhost:8888',
+    LIVE_SERVER_URL,
   },
   reactStrictMode: false,
 };

src/app/(protected)/api/rtmp/hls/[path]/route.ts

@@ -0,0 +1,31 @@
+import { validateRequest } from "@/lib/auth";
+import fsP from 'fs/promises';
+import fs from 'fs'; 
+
+export async function GET(request: Request, { params }: { params: Promise<{ path: string }> }) {
+  const { path } = await params;
+  const { user } = await validateRequest();
+  if (!user) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+  if (path.includes('..')) {
+    return new Response("nuh uh", { status: 403 });
+  }
+
+  const basePath = '/dev/shm/hls';
+  const filePath = `${basePath}/${path}`;
+  const exists = fs.existsSync(filePath);
+
+  if (!exists) {
+    return new Response("Not Found", { status: 404 });
+  }
+
+  const file = await fsP.readFile(filePath);
+  return new Response(file, {
+    headers: {
+      'Content-Type': 'application/octet-stream',
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET',
+    },
+  });
+}

src/components/app/StreamPlayer/StreamPlayer.tsx

@@ -20,7 +20,7 @@ export default function StreamPlayer() {
   return (
     <MediaController className='w-full aspect-video'>
       <HlsVideo
-        src={`${process.env.LIVE_SERVER_URL}/hls/${username}.m3u8`}
+        src={`/api/rtmp/hls/${username}.m3u8`}
         slot="media"
         crossOrigin="anonymous"
         autoplay