title: nginx - Trying to secure a HLS stream through auth_request
body: <p>I took a lot of time searching for answers and believe me I tried everything.
  I am running a nginx server that pushes rtmp streams to HLS streams.</p>
  
  <p>Below is a part of my nginx.conf</p>
  
  <pre><code>location /hls {
          types {
              application/vnd.apple.mpegurl m3u8;
          }
  
          root /mnt/;
          set $auth_request_uri "http://SERVER:8000/auth_ext.php?token=$arg_token";
          auth_request /auth/;
          add_header Cache-Control no-cache; # Prevent caching of HLS fragments
          add_header Access-Control-Allow-Origin *; # Allow web player to access our playlist
      }
  
  location /auth/ {
          internal;
          proxy_pass              $auth_request_uri;
          proxy_pass_request_body off;
          proxy_set_header        Content-Length "";
          proxy_set_header        X-Original-URI $request_uri;
      }
  </code></pre>
  
  <p>I am trying to authenticate a stream through a php page, where I am getting the parameters from the URL and then responds a 200 OK if it matches a token in my DB.</p>
  
  <p>So far I managed to authenticate, meaning I can access <a href="http://SERVER:8080/hls/stream.m3u8?token=TOKEN" rel="nofollow noreferrer">http://SERVER:8080/hls/stream.m3u8?token=TOKEN</a> if the token is matching but here is what happens.</p>
  
  <p>I have a main m3u8 stream that adapts the streams according to the bandwidth, and when I access stream.m3u8 in the console I see this </p>
  
  <pre><code> http://SERVER:8080/hls/stream.m3u8?token=TOKEN
   http://SERVER:8080/hls/stream_mid.m3u8
   http://SERVER:8080/hls/stream_hd720.m3u8
   http://SERVER:8080/hls/stream_src.m3u8
  </code></pre>
  
  <p>where the last three m3u8 responds 404 because the parameters dont pass through, therefore I have a stream that never loads but the URL does respond.
  Moreover in the m3u8 themselves, the .ts files also get 404.</p>
  
  <p>How to deal with this so whenever ONE first call to the first m3u8 is authenticated, the remaining m3u8 and the ts files can be accessed or return a 200 code ? </p>
  
  <p>I really hope I made myself clear, I can provide with more details</p>
  
  <p>Thank you all</p>