# Medicache not forwarding authentication cookies to origin server

**URL:** <https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434>\
**Category:** Wowza Streaming Engine\
**Created:** [March 14, 2014, 3:09pm UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434 "2014-03-14T15:09:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Uma\_Reddy](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@Uma\_Reddy](https://community.wowza.com/u/Uma_Reddy)\
**Post date:** [March 14, 2014, 3:09pm UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434/1 "2014-03-14T15:09:57Z")

</div>

I am using mediacache with http access to a web server which stores my video content. The web server validates a session id and an access\_token before it returns any content. The wowza server (mediacache) is not sending any of the cookies it receives to the web server. How do I force the mediacache to forward all the cookies received? Is there a way to configure this?

I am using Wowza 4.01

Thanks.

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [March 15, 2014, 12:37pm UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434/2 "2014-03-15T12:37:35Z")

</div>

Hi,

No, sorry, there is not a way to do this with cookies. You can use querystrings

Richard

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [March 15, 2014, 1:18pm UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434/3 "2014-03-15T13:18:03Z")

</div>

Also, you can base64 encode the stream name with its querystring for security. You have to add this Property to the MediaCacheSource Properties container:

```auto
<Property>
	<Name>base64DecodeStreamName</Name>
	<Value>true</Value>
	<Type>Boolean</Type>
</Property>

```

Richad

---

<div class="post-metadata">

**Author:** ![Roger\_Littin1](https://avatars.discourse-cdn.com/v4/letter/r/c89c15/32.png) [@Roger\_Littin1](https://community.wowza.com/u/Roger_Littin1)\
**Post date:** [March 18, 2014, 9:12am UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434/4 "2014-03-18T09:12:32Z")

</div>

Hi,

The Media Cache requests from Wowza to the web server are not related to any single player session so what you are wanting to do would not be possible. Also the Media Cache uses a very simple http client that does not support cookies.

If you want to validate your player session, you can use onHTTPSessionCreate. Any cookies that have been sent to the server should be visible in the session.

As Richard mentioned, you can pass query string variables through to the web server via Media Cache but you do need to encode the stream name complete with the variables so that they do not get stripped out by the session.

Roger.

---

<div class="post-metadata">

**Author:** ![Uma\_Reddy](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@Uma\_Reddy](https://community.wowza.com/u/Uma_Reddy)\
**Post date:** [March 17, 2014, 2:13pm UTC](https://community.wowza.com/t/medicache-not-forwarding-authentication-cookies-to-origin-server/42434/5 "2014-03-17T14:13:23Z")

</div>

Thank you Richard.

The “Origin Server” is used by multiple web servers as the store for content. The Origin server implements a security mechanism where it needs the access\_token which is a part of the cookie. It is not possible to change the Origin server security implementation. But what I could do is to implement the security mechanism as a Wowza module. This way I can implement the security mechanism in “onHTTPSessionCreate”. If the authentications fails then I can reject the HTTP request else Wowza will pass the request to the origin Server. We can configure the origin server to skip the security check for some known source IP’s.

On Wireshark I find that the HTTP request arriving at Wowza:1935 has the cookies and query string. I assume I sill have access to these in “onHTTPSessionCreate” call back. Is this correct?

I am new to Java and using Eclipse IDE for the first time, the task is overwhelming. Is there a tutorial which describes how I could create a custom module and create a Jar file out of it. Essentially how would I create Custom modules without using Wowza IDE.

Thanks.