Authorise the segment, not the sessionAuthorise the segment, not the session

There is a default in streaming that nobody chose: check entitlement at the start of playback, then serve the rest. It is convenient, it is fast, and it means a manifest URL is a bearer credential for the whole title until it expires.

What the default actually grants

A viewer who is entitled at 20:00 receives a manifest. Everything downstream of that manifest is served on request. So:

• A link shared at 20:01 works for the recipient.
• A subscription cancelled at 20:05 keeps playing.
• A geographic rule evaluated at 20:00 is never re-evaluated.

None of those is a bug in the implementation. They are all direct consequences of authorising a session rather than a request.

The alternative, and what it costs

Treat every segment request as a request that needs authorising. The edge verifies a signed, expiring token scoped to that viewer, that title and that window, on every segment.

# One segment request, as the edge sees it.
GET /v/abc/1080p/seg-00421.ts
  ?t=eyJhbGciOi...            # signed, expiring, scoped
  
# Edge does, in order:
#   1. verify signature            (no network call)
#   2. check exp / nbf             (no network call)
#   3. check title + viewer claims (no network call)
#   4. serve from slice cache

The cost is a signature verification on a request that was already being made. It does not touch the network, it does not touch a database, and it is dwarfed by the disk read it precedes.

What it buys is that revocation takes effect mid-stream, a shared link stops working when the token expires rather than when the session ends, and window rules are enforced continuously rather than once. Territory is the one rule this does not yet close: the edge resolves the country and logs it, and there is no deny map in front of it.

The part people push back on

"Doesn't checking every segment make playback slower?" No measurably — see above. The real objection is operational: a token that expires mid-film has to be renewable without interrupting playback, and getting that renewal wrong is far more visible than the problem it solves. That is the piece worth spending design time on, and it is where our first attempt was wrong.