[Issue] Anti-Bot Error When Playing Videos Natively

[JCollins2048]

System Information

Television

Model: Hisense Roku TV 43R6+ (C256X)
Software version: 14.5.4 (5944)
Connection type: Wi-Fi

Playlet

App Version: 0.25.0
Library Version: 0.38.1

Summary of Problem

Attempting to play any video on the Playlet Roku TV app natively presents a YouTube anti-'bot error message.

Steps to Reproduce

1. Open Playlet app on a Roku TV.
2. Disable Invidious backend, if enabled.
3. Find and select any video at all. Login state doesn't matter.

More Details

Oh, boy… Here we go.

Sometime after 1:00 AM EST*, videos stopped loading on the Playlet app. I'm still logged in to the app just fine. I can see my feed (playlists, new videos, et cetera), and I can select them. I just can't load or watch them. Instead, the following error message displays:
^{* Not sure on the exact time — I was watching a long video.}

Video load error

Failed to load video information for [video code]
Sign in to confirm you're not a bot
This helps protect our community. Learn more

When I rebooted my TV, nothing happened. When I logged out and logged back in, nothing changed. When I logged out and tired a random video, nothing changed. However, "streaming" from the YouTube app on my iPad through Playlet still works just as it did before. It seems like something is broken with how Playlet handles videos in and of itself…
^{There's no reason it would break, but I figured I'd mention it.}

I hope there's a way around this… I was greatly enjoying being able to use my real playlists and actually having the videos get tagged as "watched"!

Best of luck, and thanks for making this thing cooler with every update!

Relevant Media

A cropped image of the error on a Hisense Roku TV.

[iBicha]

Thanks for the detailed report. Keeping an eye on this.

A couple of notes

I want to clarify this point:

Find and select any video at all. Login state doesn't matter.

This might be confusing, because the error message asks you to login, but you are already logged in.
Playlet only uses your login information for your data specifically (Recommendations, Subscriptions, Playlists and Watch History) - for anything else, like viewing a channel, search, or even playing a video, Playlet doesn't send user token with these requests.
To get technical, Playlet plays videos by using the iOS client (basically it pretends to be an iPhone when fetching video data). This is because iOS is the only client that doesn't require passing certain security checks (nsig decryption, PoToken, etc). These security checks require a javascript execution environment, but Roku doesn't support that (technically the official YouTube app can run javascript, because Roku gave it access to the NDK "Native Development Kit", but Playlet doesn't have access to NDK)
If we did try to fetch video data with login information, YouTube would block that, because we logged in using the TV client, but requesting video information using iOS client. YouTube knows this is not normal, and would block this request.

What to do

I would wait for an entire 24 hours without using Playlet. A lot of the times, "Sign in to confirm you're not a bot" triggers when a lot of data is downloaded. Also, Playlet refreshes it's Session Data (Visitor Data) every 24 hours.

What's next

If waiting doesn't help, and more and more people are starting to see this issue, then unfortunately Playlet will have to implement certain security checks (nsig decryption, PoToken, etc) by relying on a new server which would do the javascript execution part.

[iBicha]

Are you by any chance on VPN? Being on VPN significantly increases the chance of the anti-bot error (example #479 (comment))

[JCollins2048]

Originally posted 18 hours ago
Nope. No VPN here. Just my plain US-based ISP from a modem-and-router combination. Static IP, automatic DNS, all that.

This is also the first time I've ever gotten this error.
—

Alright. It's been over a day since I got the error and, as suggested, I only streamed media from the iPad to the Playlet app. After this time, I attempted to play videos on the app, itself, and everything seems back to normal. I'm not sure what I did to trigger the "please log in" error before, but I guess it was just me…

I'm gonna mark this as a bit of a fluke. I'd probably keep the report open for a couple more days to see if anyone else experiences it, but that's just me. On my end, at least, I think it's case closed.

Thank you for the detailed explanations, and as always, thank you for this wonderful app!

[JCollins2048]

Yeah, it's still doing it under normal play circumstances.

It's okay. I can still get "view credit" for my by streaming the YouTube app while logged in, and it doesn't give me any anti-'bot guff.

I wonder if this is another one of those Roku TV limits, or Google's API just being mean…

[iBicha]

Your comments has been helpful, thanks for the updates.
YouTube is trying to activate its security measures more, especially against usage without login.
As I explained, Playlet doesn't send account information to YouTube, unless needed.

Why do videos still work when casting?

The reason why videos work when you cast from the mobile app, is because of this feature: credentialTransferToken
Technically when you cast from the app, your mobile device sends a credentialTransferToken, which is an a sort of "authorization" for the TV to Play a video on your behalf.
Imagine this scenario: you're at a friends house, and you're trying to cast a video to their TV. Turns out, the video is private, and only you can see it. You would need to login on your friends TV first to do this. But you don't want to do that.
So when you cast, you essentially give the TV, a temporary, one time authorization, for only one video, to have the same permissions as you to see a video. This allows you to be able to cast a private video, or an age restricted video, even if the TV doesn't have a user logged in.

How to solve this

YouTube wants to limit as much as possible the usage of bots (by definition, where a video is being downloaded, but is not being displayed by a real user) which can't view ads.

Playlet needs to improve the authenticity of the requests it makes when not logged in (Some of this is documented in https://github.com/LuanRT/BgUtils) and to also try to use the logged-in user when it plays videos (which might require servers, because as I mentioned, Roku devices do not have javascript execution capabilities)

I will need to run multiple experiments soon to be able to figure this out. Stay tuned

[iBicha]

Small update: When I was testing, I noticed that YouTube didn't like that I was refreshing my session frequently.
With that, I've made two changes:

• Session data only refreshes after 7 days - let's see if this helps
• When casting from the Playlet web app, there's now a new button: "Play on DEVICE_NAME (ytjs)". When this option is used, YouTube.js and BgUtils are used to generate a PoToken and play the video in a more "authentic" way, and might reduce the amount of errors.
  • Bonus point: using the "Play on DEVICE_NAME (ytjs)" allows playing longer videos (a workaround for Videos longer than 5 hours cut off at that mark (HLS VOD playlist too large) #500)

These changes are currently in Canary release https://github.com/iBicha/playlet/releases/tag/canary if you can test these changes, that would be helpful. Thanks

[JCollins2048]

Looking forward to less "please, log in" errors! I'll keep you posted on this.

Thank you for plowing on! 👍

[JCollins2048]

I think this might be fixed in the Canary / Dev build. I haven't gotten a single "please, log in" error. Since two weeks ago.

I've been watching a lot of videos this weekend, in particular, and I'd think that would trigger it. Nope. It's working just fine — for me, at least.

Cheers!

[iBicha]

I'm going to keep an eye on this for a bit longer, but now I'm fairly confident that this error is because of Playlet resetting the visitor data (a randomly generated user id, so youtube can track you)
I've increased the duration of this ID to 14 days in canary. Will close soon if the amount of errors settles down.
Thanks!