authentication error in MediaMTX v1.21.0, works in v1.19.2

Which version are you using?

1.21.0 & 1.19.2

Which operating system are you using?

Windows amd64 Docker (WSL backend)

Describe the issue

HLS returns 401 authentication error in MediaMTX v1.21.0, works in v1.19.2

Summary

After upgrading MediaMTX from v1.19.2 to v1.21.0, HLS playback stopped working.

RTMP publishing continues to work correctly, and the HLS master playlist is generated successfully. However, MediaMTX returns HTTP 401 when requesting the HLS video child playlist:

{"status":"error","error":"authentication error"}

Rolling the Docker image back from v1.21.0 to v1.19.2 immediately restores HLS playback with the same configuration and infrastructure.

Environment

• MediaMTX: v1.21.0 (failure)
• MediaMTX: v1.19.2 (works)
• Docker image: bluenviron/mediamtx
• Host OS: Windows Server
• Docker Desktop
• HLS accessed through a Cloudflare Tunnel
• RTMP published from a mobile device
• Browser: Microsoft Edge 152 / Chromium
• Video: H.264
• Audio: MPEG-4 AAC

MediaMTX configuration

logLevel: info

rtmp: yes
rtmpAddress: :1935

hls: yes
hlsAddress: :8888
hlsAlwaysRemux: yes

paths:
  all:
    source: publisher

There is no authMethod, authInternalUsers, authHTTPAddress, JWT configuration, username/password, or other explicit authentication configuration in mediamtx.yml.

Network topology

The setup consists of:

Mobile RTMP publisher
        ↓
     Internet
        ↓
    Router/NAT
        ↓
MediaMTX RTMP listener
        ↓
     HLS muxer
        ↓
Cloudflare Tunnel
        ↓
     HLS player

The Cloudflare Tunnel is only used for HTTP/HLS access. RTMP connects directly to the MediaMTX RTMP listener.

Observed behavior in v1.21.0

RTMP publishing succeeds.

MediaMTX logs show the stream becoming available and HLS being generated:

[path <stream>] stream is available and online, 2 tracks (H264, MPEG-4 Audio)

[HLS] [muxer <stream>] created automatically

[HLS] [muxer <stream>] is converting into HLS, 2 tracks (MPEG-4 Audio, H264)

The HLS master playlist is accessible.

The initial HLS request returns a redirect that sets a cookieCheck cookie:

HTTP/1.1 302 Found
Location: /<stream>/index.m3u8?cookieCheck=1
Server: mediamtx
Set-Cookie: cookieCheck=1; HttpOnly; Secure; SameSite=None; Partitioned

Following the redirect produces HTTP 200 and a valid HLS master playlist.

The master playlist contains session-specific child playlist URLs, for example:

#EXT-X-MEDIA:TYPE=AUDIO,... URI="audio2_stream.m3u8?session=<UUID>"

#EXT-X-STREAM-INF:...
video1_stream.m3u8?session=<UUID>

However, requesting the child playlist produces:

HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Server: mediamtx
Content-Length: 49

{"status":"error","error":"authentication error"}

This occurs even when supplying the exact session UUID generated in the master playlist.

Cloudflare was ruled out

The same 401 response occurs when accessing the MediaMTX HLS endpoint directly over the local network, bypassing Cloudflare entirely.

The direct response is:

HTTP/1.1 401 Unauthorized
Server: mediamtx

{"status":"error","error":"authentication error"}

Therefore the 401 originates from MediaMTX rather than the reverse proxy.

Authentication configuration

There is no explicit authentication configuration in mediamtx.yml.

The complete configuration is:

logLevel: info

rtmp: yes
rtmpAddress: :1935

hls: yes
hlsAddress: :8888
hlsAlwaysRemux: yes

paths:
  all:
    source: publisher

Version comparison

MediaMTX v1.21.0

• RTMP publishing: works
• HLS muxing: works
• HLS master playlist: HTTP 200
• HLS child playlist: HTTP 401
• Error: authentication error

MediaMTX v1.19.2

Using the same:

• Docker host
• Docker configuration
• MediaMTX configuration
• RTMP publisher
• Cloudflare Tunnel
• HLS player
• Network configuration

HLS playback works correctly.

The only intentional change was the MediaMTX image version:

image: bluenviron/mediamtx:1.21.0

changed to:

image: bluenviron/mediamtx:1.19.2

After recreating the container with v1.19.2, HLS playback immediately works again.

Reproduction

1. Run MediaMTX v1.21.0 using the configuration above.
2. Publish an H.264/AAC RTMP stream to any path.
3. Open the corresponding HLS master playlist.
4. Follow the cookieCheck=1 redirect.
5. Observe that the master playlist is returned successfully.
6. Take the video1_stream.m3u8?session=<UUID> URL generated by the master playlist.
7. Request that child playlist.
8. Observe HTTP 401:

{"status":"error","error":"authentication error"}

1. Replace MediaMTX v1.21.0 with v1.19.2 without changing the configuration.
2. Repeat the test.
3. HLS playback works.

Expected behavior

With no authentication configured, a valid HLS session generated by the master playlist should allow the client to retrieve the corresponding HLS child playlists.

Actual behavior

MediaMTX v1.21.0 generates the HLS master playlist and session UUID successfully but rejects the corresponding child playlist with:

401 Unauthorized
{"status":"error","error":"authentication error"}

Workaround

Downgrading from MediaMTX v1.21.0 to v1.19.2 restores HLS playback without any other configuration changes.

Additional notes

The issue appears to involve the HLS session/cookie authentication mechanism in the affected version.

The failure is reproducible locally without the reverse proxy, so this does not appear to be a Cloudflare Tunnel or reverse-proxy issue.

The v1.19.2 → v1.21.0 version comparison provides a reliable regression test.

Describe how to replicate the issue

1. start the MediaMTX
2. publish with ...
3. read with ...

MediaMTX configuration

rtmp: yes
rtmpAddress: :1935

hls: yes
hlsAddress: :8888
hlsAlwaysRemux: yes

paths:
  all:
    source: publisher

MediaMTX logs

No response

Packet dump

No response