starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #4263] [MERGED] Add new api endpoint for direct playing audio files using session id #4201

New Issue
Closed
opened 2026-04-25 00:18:45 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:18:45 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/4263
Author: @advplyr
Created: 5/6/2025
Status: ✅ Merged
Merged: 5/6/2025
Merged by: @advplyr

Base: master ← Head: new_session_track_endpoint

📝 Commits (2)

  • 336de49 Add new api endpoint for direct playing audio files using session id #4259
  • d953116 Fix for HLS transcode urls

📊 Changes

5 files changed (+66 additions, -10 deletions)

View changed files

📝 client/players/AudioTrack.js (+10 -9)
📝 client/players/PlayerHandler.js (+1 -1)
📝 server/controllers/SessionController.js (+47 -0)
📝 server/managers/PlaybackSessionManager.js (+6 -0)
📝 server/routers/PublicRouter.js (+2 -0)

📄 Description

Brief summary

When direct playing, Audio track URLs include the user token. As outlined in #4259 this is a security concern when casting because you aren't making the request to your server.

This PR creates a separate API endpoint at /public/session/:sessionId/track/:index that is only accessible while the session is open. This endpoint debug logs the session id, username and track index.

Which issue is fixed?

Fixes #4259

In-depth Description

Open playback sessions are automatically closed after 36 hours and a new session id (UUIDv4) is created each time a session is opened.

There is a remaining update to be made for HLS streams because they still include the user token in the URL.
This PR fully addresses #4259 because HLS isn't supported for casting, only direct play.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/4263 **Author:** [@advplyr](https://github.com/advplyr) **Created:** 5/6/2025 **Status:** ✅ Merged **Merged:** 5/6/2025 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `new_session_track_endpoint` --- ### 📝 Commits (2) - [`336de49`](https://github.com/advplyr/audiobookshelf/commit/336de49d8dbc67c4e88a2777efc93e6306a5333b) Add new api endpoint for direct playing audio files using session id #4259 - [`d953116`](https://github.com/advplyr/audiobookshelf/commit/d9531166b6100e36382423b2745de0f3fb61d4a3) Fix for HLS transcode urls ### 📊 Changes **5 files changed** (+66 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `client/players/AudioTrack.js` (+10 -9) 📝 `client/players/PlayerHandler.js` (+1 -1) 📝 `server/controllers/SessionController.js` (+47 -0) 📝 `server/managers/PlaybackSessionManager.js` (+6 -0) 📝 `server/routers/PublicRouter.js` (+2 -0) </details> ### 📄 Description <!-- For Work In Progress Pull Requests, please use the Draft PR feature, see https://github.blog/2019-02-14-introducing-draft-pull-requests/ for further details. If you do not follow this template, the PR may be closed without review. Please ensure all checks pass. If you are a new contributor, the workflows will need to be manually approved before they run. --> ## Brief summary When direct playing, Audio track URLs include the user token. As outlined in #4259 this is a security concern when casting because you aren't making the request to your server. This PR creates a separate API endpoint at `/public/session/:sessionId/track/:index` that is only accessible while the session is open. This endpoint debug logs the session id, username and track index. ## Which issue is fixed? Fixes #4259 ## In-depth Description Open playback sessions are automatically closed after 36 hours and a new session id (UUIDv4) is created each time a session is opened. There is a remaining update to be made for HLS streams because they still include the user token in the URL. This PR fully addresses #4259 because HLS isn't supported for casting, only direct play. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:18:45 +02:00
adam closed this issue 2026-04-25 00:18:45 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#4201
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?