search

iv-org / invidious

Invidious is an alternative front-end to YouTube
https://invidious.io
GNU Affero General Public License v3.0
16.42k stars 1.85k forks source link

[Enhancement] Do not leak po token in videoplayback requests to clients #4841

Open MMaster opened 3 months ago

MMaster commented 3 months ago

po token is leaked to clients in videoplayback request URLs. I'm not entirely sure if it can be abused, but since pot is identifiable info it may be better to not leak it to clients watching videos on invidious instance.

Describe the solution you'd like Rewrite the URL internally to add pot without exposing it to clients eg in video_playback route.

unixfox commented 3 months ago

It's the same issue as https://github.com/iv-org/invidious/issues/2142

Ideally we would like to do something about it, but ultimately it's too cumbersome to deal with.

Especially since we support the ability to turn off "proxy" and this won't work anymore if we hide the pot= parameter because the requests are directly sent to google servers by the browser/client.

Read also the big downside for public instances by doing this: https://github.com/iv-org/invidious/issues/2142#issuecomment-1602337128. Each separate proxy program (example http3-ytproxy) would have to be adapted for this case.