YouTube doesn't have Access-Control-Allow-Origin header

[sandrosc]

So I tried to do this and failed pretty early: Issue #25

192.168.0.105/:1 Fetch API cannot load https://www.youtube.com/watch?v=A02s8omM_hI. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://192.168.0.105:9966' is therefore not allowed access. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

undefined:1 Uncaught (in promise) TypeError: Failed to fetch(…)

192.168.0.105/:1 Fetch API cannot load https://www.youtube.com/get_video_info?video_id=A02s8omM_hI&eurl=https%3A%2F%2Fyoutube.googleapis.com%2Fv%2FA02s8omM_hI&ps=default&gl=US&hl=en. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://192.168.0.105:9966' is therefore not allowed access. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

The author of this stackoverflow question had a very similar problem:
http://stackoverflow.com/a/9327508

Do you have any idea how/whether we can work around this?

Regards, Spreadyy

[fent]

YouTubeCenter has the download video feature from the frontend, I would look into how they do it.

[sandrosc]

YouTubeCenter is a browser extension so it also runs on the youtube domain and can therefore interact with YouTube.

[fent]

Ah yeah true. Not sure you can get around CORS then. Is using a proxy an option?

[sandrosc]

How would you do that? Setting up a web service that downloads and prepares the video for the frontend misses the point or did you think of something else?

[fent]

Yes, like that. Looks like even the actual video is restricted by CORS too.

[sandrosc]

Hmm my goal is to setup a static website that does that on its own, setting up a service would be possible but that would cost money I'd many people use it. A static webpage could be hosted by gh-pages for example and could be scaled really well. I will contact YouTube to see whether they can add that particular header.

[fent]

You could have service only retrieve the download link, and then have the user use their own bandwidth to access and download that link.

[sandrosc]

Do you think that would work? Are download links static or generated for each user?

[sandrosc]

Btw: https://groups.google.com/a/googleproductforums.com/d/msgid/youtube/8b94f81b-4b9a-431d-b7c0-de15436f1688%40googleproductforums.com

[fent]

They're not static, and I think they're only available temporarily after the video page is requested.

Not sure that YouTube will want to enable CORS, they probably don't endorse this library and similar ones. It's something due to giving their content providers some security over their content. And they want users to view their videos only through YouTube, for the ad revenue.

[sandrosc]

Do you think Youtube uses some magic to ensure that the download link is only used by the IP adress that requested it?

[fent]

A while ago I ran into a page that did something similar, it returned a list of formats with the download url given a video url. The download worked for me, so no I don't think so.

[sandrosc]

Ok, I will take a look at that.

[sandrosc]

I tried something new:

• Save info object in info.json file
• Script in browser uses $.getJSON to load the info.json file
• Then ytdl.downloadFromInfo is called with the info parameter

Because ytdl uses setImmediate which is not included in most browsers I had to use IE. Just kidding, there's a fix (second link):
https://developer.mozilla.org/en/docs/Web/API/Window/setImmediate
browserify/browserify#985 (comment)

However, the following happens:
Fetch API cannot load https://r5---sn-1gi7zn7s.googlevideo.com/videoplayback?id=o-AAJJL0QUuVe5f8k…97AEAC3833BFDF40A5A0DF890A75492&ms=au&mm=31&mn=sn-1gi7zn7s&upn=W8UVvTnZjK0. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9966' is therefore not allowed access. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

My guess is that the page you ran into did indeed provide you with the link to download the video, but the download itself was started from the browser and not from the script as I'm trying to do. The same thing would happen if I loaded an iFrame with an external URL, the browser requests it regardless of CORS (direct request) but the javascript has no possibilities to interact with the loaded content.

[sandrosc]

So yeah, if you don't have additional input you can close the issue. After all this is not the fault of ytdl.