prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  plugins.vtvgo: '403 Client Error: Forbidden for url: ...'
  ### Checklist
  
  - [X] This is a plugin issue and not a different kind of issue
  - [X] [I have read the contribution guidelines](https://github.com/streamlink/streamlink/blob/master/CONTRIBUTING.md#contributing-to-streamlink)
  - [X] [I have checked the list of open and recently closed plugin issues](https://github.com/streamlink/streamlink/issues?q=is%3Aissue+label%3A%22plugin+issue%22)
  - [X] [I have checked the commit log of the master branch](https://github.com/streamlink/streamlink/commits/master)
  
  ### Streamlink version
  
  Latest build from the master branch
  
  ### Description
  
  Last month VtvGo added cookie requirements for the stream playlist, and now it seems that they added another security layer. The request to the website returns error 403.
  
  ### Debug log
  
  ```text
  streamlink https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html --loglevel=debug
  [cli][debug] OS:         Linux-5.15.0-53-generic-x86_64-with-glibc2.35
  [cli][debug] Python:     3.10.6
  [cli][debug] Streamlink: 5.1.2+4.g68dad105
  [cli][debug] Dependencies:
  [cli][debug]  certifi: 2022.9.24
  [cli][debug]  isodate: 0.6.1
  [cli][debug]  lxml: 4.9.1
  [cli][debug]  pycountry: 22.3.5
  [cli][debug]  pycryptodome: 3.15.0
  [cli][debug]  PySocks: 1.7.1
  [cli][debug]  requests: 2.28.1
  [cli][debug]  urllib3: 1.26.12
  [cli][debug]  websocket-client: 1.4.1
  [cli][debug]  importlib-metadata: 4.6.4
  [cli][debug] Arguments:
  [cli][debug]  url=https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html
  [cli][debug]  --loglevel=debug
  [cli][info] Found matching plugin vtvgo for URL https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html
  error: Unable to open URL: https://vtvgo.vn/ajax-get-stream (403 Client Error: Forbidden for url: https://vtvgo.vn/ajax-get-stream)
  ```
  
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `src/streamlink/plugins/vtvgo.py`
  Content:
  ```
  1 """
  2 $description Live TV channels from VTV, a Vietnamese public, state-owned broadcaster.
  3 $url vtvgo.vn
  4 $type live
  5 """
  6 
  7 import logging
  8 import re
  9 
  10 from streamlink.plugin import Plugin, pluginmatcher
  11 from streamlink.plugin.api import validate
  12 from streamlink.stream.hls import HLSStream
  13 
  14 log = logging.getLogger(__name__)
  15 
  16 
  17 @pluginmatcher(re.compile(
  18     r"https?://vtvgo\.vn/xem-truc-tuyen-kenh-"
  19 ))
  20 class VTVgo(Plugin):
  21     AJAX_URL = "https://vtvgo.vn/ajax-get-stream"
  22 
  23     def _get_streams(self):
  24         # get cookies
  25         self.session.http.get("https://vtvgo.vn/")
  26 
  27         self.session.http.headers.update({
  28             "Origin": "https://vtvgo.vn",
  29             "Referer": self.url,
  30             "X-Requested-With": "XMLHttpRequest",
  31         })
  32 
  33         params = self.session.http.get(self.url, schema=validate.Schema(
  34             validate.parse_html(),
  35             validate.xml_xpath_string(".//script[contains(text(),'setplayer(')][1]/text()"),
  36             validate.none_or_all(
  37                 validate.regex(
  38                     re.compile(r"""var\s+(?P<key>(?:type_)?id|time|token)\s*=\s*["']?(?P<value>[^"']+)["']?;"""),
  39                     method="findall",
  40                 ),
  41                 [
  42                     ("id", int),
  43                     ("type_id", str),
  44                     ("time", str),
  45                     ("token", str),
  46                 ],
  47             ),
  48         ))
  49         if not params:
  50             return
  51 
  52         log.trace(f"{params!r}")
  53         hls_url = self.session.http.post(
  54             self.AJAX_URL,
  55             data=dict(params),
  56             schema=validate.Schema(
  57                 validate.parse_json(),
  58                 {"stream_url": [validate.url()]},
  59                 validate.get(("stream_url", 0)),
  60             ),
  61         )
  62 
  63         return HLSStream.parse_variant_playlist(self.session, hls_url)
  64 
  65 
  66 __plugin__ = VTVgo
  67
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/src/streamlink/plugins/vtvgo.py b/src/streamlink/plugins/vtvgo.py
  --- a/src/streamlink/plugins/vtvgo.py
  +++ b/src/streamlink/plugins/vtvgo.py
  @@ -27,6 +27,7 @@
           self.session.http.headers.update({
               "Origin": "https://vtvgo.vn",
               "Referer": self.url,
  +            "Sec-Fetch-Site": "same-origin",
               "X-Requested-With": "XMLHttpRequest",
           })
  
verification_info: {"golden_diff": "diff --git a/src/streamlink/plugins/vtvgo.py b/src/streamlink/plugins/vtvgo.py\n--- a/src/streamlink/plugins/vtvgo.py\n+++ b/src/streamlink/plugins/vtvgo.py\n@@ -27,6 +27,7 @@\n         self.session.http.headers.update({\n             \"Origin\": \"https://vtvgo.vn\",\n             \"Referer\": self.url,\n+            \"Sec-Fetch-Site\": \"same-origin\",\n             \"X-Requested-With\": \"XMLHttpRequest\",\n         })\n", "issue": "plugins.vtvgo: '403 Client Error: Forbidden for url: ...'\n### Checklist\n\n- [X] This is a plugin issue and not a different kind of issue\n- [X] [I have read the contribution guidelines](https://github.com/streamlink/streamlink/blob/master/CONTRIBUTING.md#contributing-to-streamlink)\n- [X] [I have checked the list of open and recently closed plugin issues](https://github.com/streamlink/streamlink/issues?q=is%3Aissue+label%3A%22plugin+issue%22)\n- [X] [I have checked the commit log of the master branch](https://github.com/streamlink/streamlink/commits/master)\n\n### Streamlink version\n\nLatest build from the master branch\n\n### Description\n\nLast month VtvGo added cookie requirements for the stream playlist, and now it seems that they added another security layer. The request to the website returns error 403.\n\n### Debug log\n\n```text\nstreamlink https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html --loglevel=debug\r\n[cli][debug] OS:         Linux-5.15.0-53-generic-x86_64-with-glibc2.35\r\n[cli][debug] Python:     3.10.6\r\n[cli][debug] Streamlink: 5.1.2+4.g68dad105\r\n[cli][debug] Dependencies:\r\n[cli][debug]  certifi: 2022.9.24\r\n[cli][debug]  isodate: 0.6.1\r\n[cli][debug]  lxml: 4.9.1\r\n[cli][debug]  pycountry: 22.3.5\r\n[cli][debug]  pycryptodome: 3.15.0\r\n[cli][debug]  PySocks: 1.7.1\r\n[cli][debug]  requests: 2.28.1\r\n[cli][debug]  urllib3: 1.26.12\r\n[cli][debug]  websocket-client: 1.4.1\r\n[cli][debug]  importlib-metadata: 4.6.4\r\n[cli][debug] Arguments:\r\n[cli][debug]  url=https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html\r\n[cli][debug]  --loglevel=debug\r\n[cli][info] Found matching plugin vtvgo for URL https://vtvgo.vn/xem-truc-tuyen-kenh-vtv3-3.html\r\nerror: Unable to open URL: https://vtvgo.vn/ajax-get-stream (403 Client Error: Forbidden for url: https://vtvgo.vn/ajax-get-stream)\n```\n\n", "before_files": [{"content": "\"\"\"\n$description Live TV channels from VTV, a Vietnamese public, state-owned broadcaster.\n$url vtvgo.vn\n$type live\n\"\"\"\n\nimport logging\nimport re\n\nfrom streamlink.plugin import Plugin, pluginmatcher\nfrom streamlink.plugin.api import validate\nfrom streamlink.stream.hls import HLSStream\n\nlog = logging.getLogger(__name__)\n\n\n@pluginmatcher(re.compile(\n    r\"https?://vtvgo\\.vn/xem-truc-tuyen-kenh-\"\n))\nclass VTVgo(Plugin):\n    AJAX_URL = \"https://vtvgo.vn/ajax-get-stream\"\n\n    def _get_streams(self):\n        # get cookies\n        self.session.http.get(\"https://vtvgo.vn/\")\n\n        self.session.http.headers.update({\n            \"Origin\": \"https://vtvgo.vn\",\n            \"Referer\": self.url,\n            \"X-Requested-With\": \"XMLHttpRequest\",\n        })\n\n        params = self.session.http.get(self.url, schema=validate.Schema(\n            validate.parse_html(),\n            validate.xml_xpath_string(\".//script[contains(text(),'setplayer(')][1]/text()\"),\n            validate.none_or_all(\n                validate.regex(\n                    re.compile(r\"\"\"var\\s+(?P<key>(?:type_)?id|time|token)\\s*=\\s*[\"']?(?P<value>[^\"']+)[\"']?;\"\"\"),\n                    method=\"findall\",\n                ),\n                [\n                    (\"id\", int),\n                    (\"type_id\", str),\n                    (\"time\", str),\n                    (\"token\", str),\n                ],\n            ),\n        ))\n        if not params:\n            return\n\n        log.trace(f\"{params!r}\")\n        hls_url = self.session.http.post(\n            self.AJAX_URL,\n            data=dict(params),\n            schema=validate.Schema(\n                validate.parse_json(),\n                {\"stream_url\": [validate.url()]},\n                validate.get((\"stream_url\", 0)),\n            ),\n        )\n\n        return HLSStream.parse_variant_playlist(self.session, hls_url)\n\n\n__plugin__ = VTVgo\n", "path": "src/streamlink/plugins/vtvgo.py"}], "after_files": [{"content": "\"\"\"\n$description Live TV channels from VTV, a Vietnamese public, state-owned broadcaster.\n$url vtvgo.vn\n$type live\n\"\"\"\n\nimport logging\nimport re\n\nfrom streamlink.plugin import Plugin, pluginmatcher\nfrom streamlink.plugin.api import validate\nfrom streamlink.stream.hls import HLSStream\n\nlog = logging.getLogger(__name__)\n\n\n@pluginmatcher(re.compile(\n    r\"https?://vtvgo\\.vn/xem-truc-tuyen-kenh-\"\n))\nclass VTVgo(Plugin):\n    AJAX_URL = \"https://vtvgo.vn/ajax-get-stream\"\n\n    def _get_streams(self):\n        # get cookies\n        self.session.http.get(\"https://vtvgo.vn/\")\n\n        self.session.http.headers.update({\n            \"Origin\": \"https://vtvgo.vn\",\n            \"Referer\": self.url,\n            \"Sec-Fetch-Site\": \"same-origin\",\n            \"X-Requested-With\": \"XMLHttpRequest\",\n        })\n\n        params = self.session.http.get(self.url, schema=validate.Schema(\n            validate.parse_html(),\n            validate.xml_xpath_string(\".//script[contains(text(),'setplayer(')][1]/text()\"),\n            validate.none_or_all(\n                validate.regex(\n                    re.compile(r\"\"\"var\\s+(?P<key>(?:type_)?id|time|token)\\s*=\\s*[\"']?(?P<value>[^\"']+)[\"']?;\"\"\"),\n                    method=\"findall\",\n                ),\n                [\n                    (\"id\", int),\n                    (\"type_id\", str),\n                    (\"time\", str),\n                    (\"token\", str),\n                ],\n            ),\n        ))\n        if not params:\n            return\n\n        log.trace(f\"{params!r}\")\n        hls_url = self.session.http.post(\n            self.AJAX_URL,\n            data=dict(params),\n            schema=validate.Schema(\n                validate.parse_json(),\n                {\"stream_url\": [validate.url()]},\n                validate.get((\"stream_url\", 0)),\n            ),\n        )\n\n        return HLSStream.parse_variant_playlist(self.session, hls_url)\n\n\n__plugin__ = VTVgo\n", "path": "src/streamlink/plugins/vtvgo.py"}]}