How to fix youtube streams with status 403 forbidden

[AlvaroRojas]

Hi @Tyrrrz

I wan to offer some ideas to make the project even better, there is no contribute guidelines so will share them here.

When getting the manifests for a video id, it only checks for a signature in the CipherData property, however some times the signature will come from the stream links in a "sig" parameter, so this property:

public string? Signature => Memo.Cache(this, () =>
			CipherData?.GetValueOrDefault("s")
		);

Needs to do something like this:

public string? Signature => Memo.Cache(this, () =>
			CipherData?.GetValueOrDefault("s") ??

			Url?
                .Pipe(s => UriEx.TryGetQueryParameterValue(s, "sig"))
		);

Afterwards, a new check should be added in StreamClient GetStreamInfosAsync function:

if (!playerResponse.IsPlayable || playerResponse.Streams.FirstOrDefault()?.Signature != null)
        {
            await EnsureCipherManifestResolvedAsync(cancellationToken);
            playerResponse = await _controller.GetPlayerResponseAsync(videoId, _signatureTimestamp, cancellationToken);
        }

That way this code is no longer necessary:

 // YouTube sometimes returns stream URLs that produce 403 Forbidden errors when accessed.
            // This happens for both protected and non-protected streams, so the cause is unclear.
            // As a workaround, we can access one of the stream URLs and retry if it fails.
            using var response = await _http.HeadAsync(streamInfos.First().Url, cancellationToken);
            if ((int)response.StatusCode == 403 && retriesRemaining > 0)
                continue;

            response.EnsureSuccessStatusCode();

Hope this helps!

[Tyrrrz]

When getting the manifests for a video id, it only checks for a signature in the CipherData property, however some times the signature will come from the stream links in a "sig" parameter, so this property:

When the signature cipher is applied, the sig parameter is missing. The Signature in cipher data is technically an obfuscated version of the signature (and should probably be named such), while sig is the final, clean version. So extracting it from the URL serves no purpose, since it won't need to be deciphered.

That way this code is no longer necessary:

That part is unrelated to signature extraction and wouldn't be affected by the changes you're suggesting. Sometimes, YouTube returns a manifest that contains cipher data and, despite deciphering the signature correctly, the URL still resolves to a 403 error. This is not because signature is missing from the manifest (it is there).