Description of authzurl and interaction with laurl unclear

[jpiesing]

I'm confused by the description of the authzurl element and its interaction with the laurl element in Draft-DASH-IF-IOPv5.1.0-Part6-for-Community-Review.pdf.pdf.

1. Is the player expected to just make an HTTP GET request to the authzurl?
   Is anything expected or permitted to be added to the authzurl, either as query arguments or as HTTP headers?
   A literal interpretation would have all players that receive the same manifest making the same request to the same URL. If that is correct then it would seem the only information that the authorization server could access in order to decide whether to return a result would be the user agent (which is insecure), geolocation information and perhaps a TLS client certificate.

2. Is the token just the return value of the HTTP GET request? Is it necessary to say anything about encoding of the token? If the authorization server decides not to authorize access, what should it return? Blank? A non-blank invalid token? Using the token with the laurl may need a name-value pair and not just a value (see below).

3. Depending on the answers to the previous questions, if someone has the URL of the manifest then it's unclear how this step adds any more security relative to just including the authorization token directly in the laurl. Is authzurl intended to have any security benefits? Is it intended to have operational benefits?

4. How is the token returned from authzurl appended to the laurl? The two normal mechanisms are either a query argument or an HTTP header but there's no way to indicate if one is preferred over the other and both are name-value pairs in some form (see above).

I feel I must be missing something (or indeed several things) but what? Hopefully it is just some context.

[dsilhavy]

Thanks @jpiesing , I second these questions from an implementation point of view. If the <dashif:Authzurl> is supposed to be handled natively by the player we will need further instructions on:

• The type of the request to be send (e.g. GET vs POST)?
• Which payload/query parameters to add to the request?
• How to handle the response. Is there a standardized return type and structure?
• How to use the returned token when issuing a license request?

I think at this point the way to use <dashif:Authzurl> would be to dispatch the URL to the application and then let the application implement the required logic. Afterward, the application can set the license request URL and headers for the media player accordingly.