withhold MJPEG stream URLs until authentication - #3405
Open
Marijn0 wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reduces information exposure by withholding MJPEG stream URLs from the rendered HTML until a user is authenticated, and ensures the stream starts automatically after login (especially for embedded frame/ pages).
Changes:
- Conditionally render the MJPEG stream
urlattribute inmain.htmlonly whencurrent_useris set. - Reload the
framepage after successful login when it was initially rendered anonymously (so the stream URL becomes available without manual refresh). - Skip MJPEG refresh attempts when the stream URL is empty, and mark the
frame()HTML response as uncacheable.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| motioneye/templates/main.html | Withholds the url attribute value for MJPEG frames unless current_user is present. |
| motioneye/static/js/main.js | Reloads the frame view after login when it was initially rendered without an authenticated user context. |
| motioneye/static/js/frame.js | Avoids attempting MJPEG refresh when the withheld URL is empty. |
| motioneye/handlers/picture.py | Adds cache-control headers to prevent cached anonymous frame() HTML from being reused after login. |
Marijn0
force-pushed
the
fix/unauthenticated-MJPEG-camera-stream-URL
branch
from
August 2, 2026 17:56
4bea979 to
d19062e
Compare
- main.html uses a Jinja if condition to render the URL only for authenticated users - doAuth() reloads the frame page after login, so the stream starts without a manual refresh - refreshCameraFrame() skips the refresh while the URL is empty - frame() marks its response uncacheable
Marijn0
force-pushed
the
fix/unauthenticated-MJPEG-camera-stream-URL
branch
from
August 18, 2026 16:02
d19062e to
1c67782
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
main.htmluses a Jinjaifcondition to render the URL only for authenticated usersdoAuth()reloads theframepage after login, so the stream starts without a manual refreshrefreshCameraFrame()skips the refresh while the URL is emptyframe()marks its response uncacheable