title: How QuickTime Player(or actually CoreMedia) works while playing HTTP stream?
body: <p>I'm working in analyze the live tv streaming from TVB(HK)</p>
  
  <p>Well known the url(s) to watch them are:</p>
  
  <pre><code>http://token.tvb.com/stream/live/hls/mobilehd_hdj.smil
  http://token.tvb.com/stream/live/hls/mobilehd_j2.smil
  http://token.tvb.com/stream/live/hls/mobilehd_inews.smil
  </code></pre>
  
  <p>We can directly watch by url(s) above in any apple native software(such as QuickTime, Safari) no matter in Mac or iOS. And also known they are using AppleCoreMedia framework. But it won't works in other platforms. You will get HTTP 200 but "access denied" in content.
  I analyzed all the traffic about it. I found that the HTTP request(by CoreMedia) to the endpoint(the server really provide video) contain a header:</p>
  
  <pre><code>x-playback-session-id: xxxxx
  </code></pre>
  
  <p>The video arrived instead of "access denied" message after I add the header manually(I tried in Chrome or Firefox), no matter what the user-agent is. But the problem occur is, I can't find any other place contain this header in earlier request(since it redirected a few times) in the traffic I dumped. So I'm curious what AppleMediaCore did when it playing http stream? Did it calculated a session id(or hash) or it got the id from somewhere i missed?</p>
  
  <p>p.s. I'm not sure TVB do a IP check or not. Since they had a copyright or legal concern so maybe blocked to access from somewhere. You maybe need a VPN.</p>