Security14 July 20262 min read

Authorise the segment, not the session

Most streaming security checks entitlement once, when playback begins, then serves everything after to whoever asks. A copied manifest URL becomes the film.

drm
tokens
aes-128
edge

Streaming has a default that few people chose: check entitlement at the start of playback, then serve the rest. It is convenient, it is fast, and it makes a manifest URL a bearer credential for the whole title until it expires.

What the default grants

A viewer who is entitled at 20:00 receives a manifest. Everything downstream of that manifest is served on request. So:

A link shared at 20:01 works for the recipient.
A subscription cancelled at 20:05 keeps playing.
A geographic rule evaluated at 20:00 is never re-evaluated.

None of those is a bug in the implementation. They are all direct consequences of authorising a session instead of a request.

The alternative, and what it costs

Treat every segment request as a request that needs authorising. The edge verifies a signed, expiring token scoped to that viewer, that title and that window, on every segment.

# One segment request, as the edge sees it.
GET /v/abc/1080p/seg-00421.ts
  ?t=eyJhbGciOi...            # signed, expiring, scoped
  
# Edge does, in order:
#   1. verify signature            (no network call)
#   2. check exp / nbf             (no network call)
#   3. check title + viewer claims (no network call)
#   4. serve from slice cache

The cost is a signature verification on a request that was already being made. It does not touch the network, it does not touch a database, and it is dwarfed by the disk read it precedes.

Revocation then takes effect mid-stream, and a shared link stops working when the token expires. Window rules are enforced continuously instead of once. Territory is the one rule this does not close: the edge resolves the country and logs it, with no deny map in front of it.

Encryption is a separate question

AES-128 applied at packaging time means no unencrypted rendition ever exists on disk, which protects the bytes at rest, while per-segment authorisation protects who may fetch them. A studio agreement will usually require a studio DRM on top. That needs a licence server, which this platform does not run today, and it is a build, not a setting.

The part people push back on

"Doesn't checking every segment make playback slower?" Not measurably, as above. The real objection is operational: a token that expires mid-film has to be renewable without interrupting playback. Getting that renewal wrong is worse than the problem it solves, and it is where our first attempt failed.

Write-ups that touch the same part of the platform.

All notes

Practice · 30 June 2026 · 2 min read