TL;DR

Anyone who copies your .m3u8 URL can watch your paywalled video from anywhere, forever. We're fixing that with an Express 5 gateway that mints short-lived JWTs, validates them on the manifest AND every segment, and rewrites playlists so the token travels automatically. Plus the bug everyone ships first: tokens that expire mid-movie.

The problem in one curl

Your app has a login wall. Your video does not:

curl -s https://cdn.example.com/course/lesson1/index.m3u8 | head -5