Skip to content
Infrastructure

Streaming proxy

Deliver Range requests and rewritten HLS or DASH assets through signed routes.

Signed stream entry points

BaPlay creates expiring signatures for persisted public IDs. Progressive media supports GET, HEAD, Range, CORS, and upstream status preservation. HLS and DASH entry manifests are fetched server-side and rewritten to opaque BaPlay asset URLs.

/stream/{id}
/stream/{id}/hls/master.m3u8
/stream/{id}/dash/manifest.mpd
/stream/{id}/asset/{encrypted-token}
/stream/{id}/template/{prefix-token}/{path}

Manifest rewriting

HLS variants, segments, encryption keys, maps, and audio assets receive exact signed tokens. DASH BaseURL and SegmentTemplate paths use bounded prefix tokens. Traversal, cross-host substitution, expired signatures, and malformed tokens are rejected.

  • • Video-on-demand manifests use cacheable responses.
  • • Live playlists receive short cache windows and stale protection.
  • • Segment responses preserve content type, range, and CORS metadata.

Quota enforcement

Player, embed, stream, and analytics routes resolve the video owner before checking monthly usage. A logged-in viewer cannot bypass or transfer another owner’s plan limit.