Skip to content

Proxy: Fix HLS proxy response header loss and m3u8 URL query parameter corruption#4658

Open
sevico wants to merge 2 commits into
ossrs:developfrom
sevico:fix/hls-proxy-header-and-url
Open

Proxy: Fix HLS proxy response header loss and m3u8 URL query parameter corruption#4658
sevico wants to merge 2 commits into
ossrs:developfrom
sevico:fix/hls-proxy-header-and-url

Conversation

@sevico
Copy link
Copy Markdown

@sevico sevico commented Apr 11, 2026

Problem

Two bugs in the HLS proxy handler (internal/protocol/http.go):

1. Response headers lost during HLS proxying

WriteHeader() is called before copying backend response headers. In Go's http.ResponseWriter, headers set after WriteHeader() are silently ignored. This causes all backend headers (Content-Type, Cache-Control, etc.) to be dropped.

2. Double ampersand (&&) in m3u8 ts URL rewriting

When the original .ts URL already contains query parameters (e.g., .ts?token=abc), the proxy generates malformed URLs:

# Before (broken)
segment.ts?spbhid=xxx&&token=abc

# After (correct)  
segment.ts?spbhid=xxx&token=abc

Fix

  1. Move WriteHeader() after setting response headers (both streaming and HLS handlers).
  2. Change && to & in the m3u8 URL rewriting logic.

Impact

  • HLS playback may fail or behave unexpectedly when backend response headers are needed by the player.
  • HLS playback fails when .ts segments have existing query parameters, because && is not a valid URL separator.

@winlinvip winlinvip added the EnglishNative This issue is conveyed exclusively in English. label Apr 11, 2026
@winlinvip winlinvip force-pushed the develop branch 3 times, most recently from 6ce415e to 6ee6f1c Compare May 17, 2026 16:09
…r corruption

1. Move WriteHeader() after setting response headers. In Go's
   http.ResponseWriter, headers set after WriteHeader() are silently
   ignored, which caused all backend response headers (Content-Type,
   Cache-Control, etc.) to be lost during HLS proxying.

2. Fix double ampersand (&&) in m3u8 ts URL rewriting. When the
   original ts URL already contains query parameters, the proxy
   generated malformed URLs like ".ts?spbhid=xxx&&token=abc"
   instead of ".ts?spbhid=xxx&token=abc".
@suzp1984 suzp1984 force-pushed the fix/hls-proxy-header-and-url branch from 044fb3c to 4fa87de Compare May 19, 2026 07:51
1. Fix test expectation: change && to & in m3u8 rewrite test
2. Add TestHLSPlayStream_ServeByBackend_HeadersCopiedFromBackend to
   verify backend headers reach the client for m3u8 responses
3. Add TestHLSPlayStream_ServeByBackend_TSHeadersCopiedFromBackend to
   verify header copy for .ts file responses
4. Add TestHTTPFlvTsConn_ServeByBackend_HeadersCopiedFromBackend to
   verify header copy for FLV/TS streaming responses

These tests protect against regression where calling WriteHeader() before
Header.Add() causes headers to be silently discarded by Go's http.ResponseWriter.
Copy link
Copy Markdown
Contributor

@suzp1984 suzp1984 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approve

I added the UT to cover the committed code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

EnglishNative This issue is conveyed exclusively in English.

Development

Successfully merging this pull request may close these issues.

3 participants