TOTP stream security

[filip-ams]

Short description

We have TOTP stream security enabled on our test server, and after some playing around, it seems that we have found a way to keep playing while the stream is blocked for the user.

This can be done by providing the subcriberId and subscriberCode only on the first request and only providing the cookie on subsequent requests. This way, it appears that Ant Media Server does not know which subscriber is watching, and thus watching the stream cannot be blocked for this anonymous user.

Logs

I have asked for logs from the user and will provide them here when I receive them.