Cross Domain user credentials passing

[iliyan85]

Is your feature request related to a problem? Please describe.

In some cases a given HLS service, that provides m3u8 playlist and chunk files can require authentication and perform user authentication process with using of Cookies, JWT, Basic Auth or even TLS Client Certificate.

It means, that the xhr request in the hls.js player must authenticate to access the given HLS service.
If the origin domain of HLS service and hls.js player is a common, everything is fine.
But in otherwise, we have an issue!
I tested the newest versions of Hls.js player and they can not provide user credentials to other domain.

Describe the solution you'd like

In the release package the solution is very simple.

In the file dist/hls.js search for the line

var xhr = this.loader = new self.XMLHttpRequest();

and you could add

xhr.withCredentials = true;

bellow it.

Additional context

No response

[phillipseamore]

This is already covered in the documentation: https://github.com/dailymotion/hls.js/blob/master/docs/API.md#xhrsetup

withCredentials can not default to true because that will cause issues with requests that have wildcard CORS headers.

[iliyan85]

Thank you!