HLS MIME types and CORS

Use media response types

Serve .m3u8 playlists as application/vnd.apple.mpegurl and MPEG-TS .ts segments as video/mp2t. Correct types help browsers, CDNs, proxies, and debugging tools interpret responses consistently.

Also verify the response body: an HTML error document can still arrive with status 200 after a misconfigured rewrite.

.m3u8  application/vnd.apple.mpegurl
.ts    video/mp2t
.zip   application/zip

When CORS matters

CORS applies when the web player page and media use different origins, including different schemes, hosts, or ports. The media origin must allow the player origin to read required responses.

If the player and every media object share one origin, cross-origin permission is normally not involved.

Allow the narrowest useful origin

Prefer the exact production player origin when the audience is controlled. A public media package intended for many unrelated sites may use a wildcard only when credentials are not required.

Apply the policy to playlists and segments, not only the top-level file. A master playlist can load while the variant request is blocked.

Access-Control-Allow-Origin: https://player.example.com

CDN and cache checks

Make sure the CDN forwards or varies on relevant Origin headers when responses differ by origin. A cached response created for one origin can otherwise be served without the header needed by another.

Confirm behavior using the actual public URL and player origin after every CDN configuration change.

Technical references

Primary documentation used to review this guide:

• MDN: Cross-Origin Resource Sharing
• AWS: Cache content based on request headers