Alessandro RosandGitHub 4c5f558006 hls, webrtc: prevent cross-origin unauthorized access (#5975) ...

when a user had previously inserted credentials into a MediaMTX
instance through a browser, and AllowOrigins was set to a wildcard,
third-party websites visited by the user were allowed to read streams
without restrictions. This is now prevented by returning "*" in
Access-Control-Allow-Origins when AllowOrigins is a wildcard, a
behavior that prevents browsers from sharing credentials with
third-party websites.

2026-07-23 23:06:15 +02:00

..

content_type.go

webrtc: fix error when charset is in Content-Type (#3126) (#3318)

2024-05-05 10:47:12 +02:00

credentials_test.go

parse HTTP username and password OR token, not both (#4517)

2025-05-11 10:20:57 +02:00

credentials.go

parse HTTP username and password OR token, not both (#4517)

2025-05-11 10:20:57 +02:00

handler_exit_on_panic.go

add read and write timeouts in HTTP servers (#5056)

2025-10-04 10:01:21 +02:00

handler_filter_requests_test.go

support multiple CORS origins (#5150)

2025-11-21 02:00:46 +01:00

handler_filter_requests.go

add read and write timeouts in HTTP servers (#5056)

2025-10-04 10:01:21 +02:00

handler_logger_test.go

improve HTTP server performance (#5886)

2026-06-20 12:03:35 +02:00

handler_logger.go

improve HTTP server performance (#5886)

2026-06-20 12:03:35 +02:00

handler_origin_test.go

hls, webrtc: prevent cross-origin unauthorized access (#5975)

2026-07-23 23:06:15 +02:00

handler_origin.go

hls, webrtc: prevent cross-origin unauthorized access (#5975)

2026-07-23 23:06:15 +02:00

handler_server_header.go

add read and write timeouts in HTTP servers (#5056)

2025-10-04 10:01:21 +02:00

handler_tracker_test.go

fix race condition when closing HTTP servers (#5390)

2026-01-31 14:09:10 +01:00

handler_tracker.go

fix race condition when closing HTTP servers (#5390)

2026-01-31 14:09:10 +01:00

handler_write_timeout.go

add read and write timeouts in HTTP servers (#5056)

2025-10-04 10:01:21 +02:00

remote_addr.go

rename httpserv into httpp (#3014)

2024-02-13 13:04:56 +01:00

server_test.go

dump unencrypted TLS sessions (#5624)

2026-04-04 14:46:43 +02:00

server.go

rtmp, rtsp: support PROXY protocol (#5754)

2026-06-05 21:37:53 +02:00