From 53c87872fc72206ad89e4099ab53337acd618e15 Mon Sep 17 00:00:00 2001 From: yvan Date: Fri, 18 Sep 2026 11:30:23 +0800 Subject: [PATCH] =?UTF-8?q?=E5=9B=9E=E9=80=80=20HTTPS=20=E4=B8=8E=E6=97=A0?= =?UTF-8?q?=20cookie=20=E6=8B=89=E6=B5=81=E6=94=B9=E5=8A=A8=EF=BC=9A?= =?UTF-8?q?=E6=94=BE=E5=BC=83=20HTTPS=20=E6=96=B9=E6=A1=88=EF=BC=8CiPhone?= =?UTF-8?q?=20=E6=92=AD=E6=94=BE=E6=94=B9=E7=94=A8=E5=A4=B8=E5=85=8B?= =?UTF-8?q?=E7=B3=BB=E7=BB=9F=E8=A7=A3=E7=A0=81=EF=BC=9B=E4=BB=85=E4=BF=9D?= =?UTF-8?q?=E7=95=99=20*.tar.gz=20=E4=B8=8E=20=5F*.py=20=E7=9A=84=20gitign?= =?UTF-8?q?ore=20=E5=8D=AB=E7=94=9F=E8=A7=84=E5=88=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 2 -- deploy/caddy-djk/Caddyfile | 14 -------------- deploy/caddy-djk/Dockerfile | 6 ------ internal/app/playback_gateway.go | 8 +------- internal/app/ui_playback.go | 11 ----------- internal/app/ui_playback_native.go | 8 +------- internal/app/ui_viewer.go | 12 ------------ 7 files changed, 2 insertions(+), 59 deletions(-) delete mode 100644 deploy/caddy-djk/Caddyfile delete mode 100644 deploy/caddy-djk/Dockerfile diff --git a/.gitignore b/.gitignore index 1304b65..1448dff 100644 --- a/.gitignore +++ b/.gitignore @@ -21,5 +21,3 @@ __pycache__/ *.tar *.tar.gz _*.py -deploy/caddy-djk/deploy_nas.py -deploy/caddy-djk/Caddyfile.nas diff --git a/deploy/caddy-djk/Caddyfile b/deploy/caddy-djk/Caddyfile deleted file mode 100644 index 2bd4643..0000000 --- a/deploy/caddy-djk/Caddyfile +++ /dev/null @@ -1,14 +0,0 @@ -{ - email yvan@xyvan.cn -} - -djk2.xyvan.cn:31513 { - tls { - dns alidns { - access_key_id {$ALI_ID} - access_key_secret {$ALI_SECRET} - } - resolvers 223.5.5.5 - } - reverse_proxy 192.168.31.32:8998 -} diff --git a/deploy/caddy-djk/Dockerfile b/deploy/caddy-djk/Dockerfile deleted file mode 100644 index 81ddee6..0000000 --- a/deploy/caddy-djk/Dockerfile +++ /dev/null @@ -1,6 +0,0 @@ -FROM caddy:2-builder AS builder -ENV GOPROXY=https://goproxy.cn,direct -RUN xcaddy build --with github.com/caddy-dns/alidns - -FROM caddy:2 -COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/internal/app/playback_gateway.go b/internal/app/playback_gateway.go index e5733c4..9ca0a37 100644 --- a/internal/app/playback_gateway.go +++ b/internal/app/playback_gateway.go @@ -259,16 +259,10 @@ func (app *UIApp) handlePlaybackMediaAsset(writer http.ResponseWriter, request * return } run, err := strconv.ParseUint(parts[1], 10, 64) - viewer := contextViewer(request.Context()) app.playbackMu.Lock() session := app.playbacks[parts[0]] - denied := err != nil || session == nil || session.run != run || session.media == nil - if !denied && viewer != nil { - denied = !viewerOwnsPlayback(request.Context(), session) - } - if denied { + if err != nil || !viewerOwnsPlayback(request.Context(), session) || session.run != run || session.media == nil { app.playbackMu.Unlock() - app.recordPlaybackAssetDenial(request, "session-unavailable") writer.WriteHeader(http.StatusGone) return } diff --git a/internal/app/ui_playback.go b/internal/app/ui_playback.go index 8848078..89cc479 100644 --- a/internal/app/ui_playback.go +++ b/internal/app/ui_playback.go @@ -94,17 +94,6 @@ func (app *UIApp) registerPlaybackRoutes(mux *http.ServeMux) { mux.HandleFunc("/api/ui/playback/progress", app.handlePlaybackProgress) } -// recordPlaybackAssetDenial 记录媒体资产请求被拒的情况，便于诊断 -// iOS/WebKit 原生媒体管线的拉流失败（区分会话失效与观看者不匹配）。 -func (app *UIApp) recordPlaybackAssetDenial(request *http.Request, reason string) { - agent := request.UserAgent() - if len(agent) > 120 { - agent = agent[:120] - } - app.downloader.recordDiagnostic(diagnosticEvent{Level: "warn", Event: "playback.asset.denied", - HTTPStatus: http.StatusGone, Message: reason + " ua=" + agent}) -} - func playbackRequestAllowed(writer http.ResponseWriter, request *http.Request, method string) bool { writer.Header().Set("Cache-Control", "private, no-store, no-transform") writer.Header().Set("X-Accel-Buffering", "no") diff --git a/internal/app/ui_playback_native.go b/internal/app/ui_playback_native.go index d535975..ad06015 100644 --- a/internal/app/ui_playback_native.go +++ b/internal/app/ui_playback_native.go @@ -95,16 +95,10 @@ func (app *UIApp) handlePlaybackNativeAsset(writer http.ResponseWriter, request writeJSON(writer, http.StatusBadRequest, map[string]string{"error": "播放请求编号无效"}) return } - viewer := contextViewer(request.Context()) app.playbackMu.Lock() session := app.playbacks[query.Get("session")] - denied := session == nil || session.run != run || session.native == nil - if !denied && viewer != nil { - denied = !viewerOwnsPlayback(request.Context(), session) - } - if denied { + if !viewerOwnsPlayback(request.Context(), session) || session.run != run || session.native == nil { app.playbackMu.Unlock() - app.recordPlaybackAssetDenial(request, "stream-unavailable") writeJSON(writer, http.StatusGone, map[string]string{"error": "此播放流已结束，请重新选择分集"}) return } diff --git a/internal/app/ui_viewer.go b/internal/app/ui_viewer.go index a3e505c..c2706ae 100644 --- a/internal/app/ui_viewer.go +++ b/internal/app/ui_viewer.go @@ -207,12 +207,6 @@ func viewerOwnsPlayback(ctx context.Context, session *playbackSession) bool { return viewer != nil && session != nil && session.viewer == viewer && playbackSourceAllowed(ctx, session) } -// playbackCapabilityPath 判断是否为无需 viewer cookie 的媒体资产路径： -// 这些 URL 中已包含不可猜测的播放会话 ID，可作为独立能力凭证。 -func playbackCapabilityPath(path string) bool { - return strings.HasPrefix(path, "/api/ui/playback/media/") || path == "/api/ui/playback/hls/index.m3u8" || path == "/api/ui/playback/hls/segment.ts" -} - func writeViewerError(writer http.ResponseWriter, status int, code, message string) { writer.Header().Set("Cache-Control", "private, no-store") writer.Header().Add("Vary", "Cookie") @@ -240,12 +234,6 @@ func (app *UIApp) withBrowserViewer(next http.Handler) http.Handler { } identity := manager.identity(request) if account.ID == "" && (identity == "" || accountCookie) { - if playbackCapabilityPath(path) { - // AVPlayer 等原生媒体管线可能不携带 cookie；播放会话 ID 本身即能力凭证， - // 由媒体资产接口自行校验会话与运行编号。 - next.ServeHTTP(writer, request) - return - } writeViewerError(writer, http.StatusUnauthorized, "viewer_required", "请刷新页面，恢复此浏览器的独立观看记录") return }