From 974b3124d017f6abc4c316d130c8d21d5d0e172d Mon Sep 17 00:00:00 2001 From: Jos Vooges | STH Date: Tue, 25 Aug 2026 02:47:41 +0200 Subject: [PATCH] Fail closed on missing playback ACK; log node /play hits for diagnosis. Co-authored-by: Cursor --- apps/master-api/src/websocket/manager.ts | 4 ++-- node/media-node/internal/streaming/server.go | 12 +++++++----- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/apps/master-api/src/websocket/manager.ts b/apps/master-api/src/websocket/manager.ts index 92036fe..c50e542 100644 --- a/apps/master-api/src/websocket/manager.ts +++ b/apps/master-api/src/websocket/manager.ts @@ -339,9 +339,9 @@ class NodeConnectionManager { const acked = new Promise((resolve) => { const timer = setTimeout(() => { - // Optimistic: node has 1s grace on /play; prefer play over hard fail. + // Fail closed: never hand Stremio a node URL without a confirmed session. this.pendingSessionAcks.delete(payload.sessionId); - resolve(true); + resolve(false); }, timeoutMs); this.pendingSessionAcks.set(payload.sessionId, { resolve, timer }); }); diff --git a/node/media-node/internal/streaming/server.go b/node/media-node/internal/streaming/server.go index 416f4e9..3acff7d 100644 --- a/node/media-node/internal/streaming/server.go +++ b/node/media-node/internal/streaming/server.go @@ -116,13 +116,15 @@ func (s *Server) handlePlay(w http.ResponseWriter, r *http.Request) { return } - clientIP := clientIP(r) - if !s.acquireIP(clientIP) { - log.Printf("GET /play/[REDACTED] rejected: too many connections from %s", clientIP) + ip := clientIP(r) + log.Printf("GET /play request from %s method=%s range=%q", ip, r.Method, r.Header.Get("Range")) + + if !s.acquireIP(ip) { + log.Printf("GET /play/[REDACTED] rejected: too many connections from %s", ip) http.Error(w, "Too Many Requests", http.StatusTooManyRequests) return } - defer s.releaseIP(clientIP) + defer s.releaseIP(ip) tokenHash := hashToken(token) sess, err := s.store.GetSessionByTokenHash(tokenHash) @@ -134,7 +136,7 @@ func (s *Server) handlePlay(w http.ResponseWriter, r *http.Request) { } } if err != nil { - log.Printf("GET /play/[REDACTED] invalid session from %s", clientIP) + log.Printf("GET /play/[REDACTED] invalid session from %s", ip) http.NotFound(w, r) return }