Alessandro RosandGitHub 4c5f558006 hls, webrtc: prevent cross-origin unauthorized access (#5975) ...

when a user had previously inserted credentials into a MediaMTX
instance through a browser, and AllowOrigins was set to a wildcard,
third-party websites visited by the user were allowed to read streams
without restrictions. This is now prevented by returning "*" in
Access-Control-Allow-Origins when AllowOrigins is a wildcard, a
behavior that prevents browsers from sharing credentials with
third-party websites.

2026-07-23 23:06:15 +02:00

..

testdata/fuzz/FuzzPaginate

api: fix crash when itemsPerPage is zero and there are items (#3425)

2024-06-04 23:09:50 +02:00

api_config_global_test.go

api: add user field to RTSP, RTMP, SRT, WebRTC conns and sessions (#5104) (#5565)

2026-03-14 00:03:58 +01:00

api_config_global.go

return a custom error when body size limit is exceeded (#5675)

2026-04-21 19:00:30 +02:00

api_config_pathdefaults_test.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api_config_pathdefaults.go

return a custom error when body size limit is exceeded (#5675)

2026-04-21 19:00:30 +02:00

api_config_paths_test.go

support encoding secondary stream with H264 (2/2) (#4485) (#5898)

2026-06-28 11:19:23 +02:00

api_config_paths.go

return a custom error when body size limit is exceeded (#5675)

2026-04-21 19:00:30 +02:00

api_hls_test.go

hls: track sessions (#962) (#5683)

2026-04-25 21:10:34 +02:00

api_hls.go

hls: track sessions (#962) (#5683)

2026-04-25 21:10:34 +02:00

api_moq_test.go

moq: support draft-19 of the specification (#5968)

2026-07-21 00:24:03 +02:00

api_moq.go

support reading and publishing with Media-over-QUIC (#5815)

2026-06-02 23:04:24 +02:00

api_paths_test.go

hls: track sessions (#962) (#5683)

2026-04-25 21:10:34 +02:00

api_paths.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api_recordings_test.go

tests: use testing.T.TempDir rather than os.TempDir (#5709)

2026-04-29 22:47:47 +02:00

api_recordings.go

prevent directory traversal attacks (#5602)

2026-03-23 20:16:12 +01:00

api_rtmp_test.go

api: add new stats (#5582)

2026-03-17 17:22:15 +01:00

api_rtmp.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api_rtsp_test.go

api: add RTSP reported lost packets (#5198) (#5579)

2026-03-16 22:10:18 +01:00

api_rtsp.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api_srt_test.go

api: add new stats (#5582)

2026-03-17 17:22:15 +01:00

api_srt.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api_test.go

hls, webrtc: prevent cross-origin unauthorized access (#5975)

2026-07-23 23:06:15 +02:00

api_webrtc_test.go

api: add new stats (#5582)

2026-03-17 17:22:15 +01:00

api_webrtc.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

api.go

ask for credentials only in case of protocols that support it (#5966)

2026-07-19 16:52:14 +02:00

custom_limit_reader.go

return a custom error when body size limit is exceeded (#5675)

2026-04-21 19:00:30 +02:00

paginate_test.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00

paginate.go

api: always reply with JSON in case of success or failure (#5252)

2025-12-07 10:37:55 +01:00