M3U8 Proxy

A small Node.js/Express proxy focused exclusively on browser-safe HLS/M3U8 delivery.

It proxies HTTP or HTTPS upstream resources through your own HTTPS endpoint, rewrites M3U8 playlists so segments and encryption keys are also proxied, and adds permissive CORS headers for browser-based players such as hls.js.

What this repository contains

• index.js — Express server and proxy routes.
• utils/proxy.js — M3U8 rewriting and HTTP/HTTPS upstream proxying.
• utils/http.js — upstream connection configuration.
• .env.example — runtime configuration template.
• DEPLOYMENT.md — VPS + Nginx + Let's Encrypt deployment guide.

There is deliberately no player UI, Video.js bundle, playground, or frontend code in this repository.

Requirements

• Node.js 20+
• npm
• Linux VPS recommended
• Nginx + HTTPS for production browser playback

Run locally

cp .env.example .env
npm install
npm start

The service listens on 127.0.0.1:3000 by default.

Health check:

http://127.0.0.1:3000/health

Proxy an M3U8

Encode the upstream URL as the url query parameter:

http://127.0.0.1:3000/m3u8-proxy?url=http%3A%2F%2Fexample.com%2Fiptv%2FMCHUP9AS7DBP5W%2F7342%2Findex.m3u8

For production, expose the service through HTTPS, for example:

https://example.com/m3u8-proxy?url=http%3A%2F%2Fexample.com%2Fiptv%2FMCHUP9AS7DBP5W%2F7342%2Findex.m3u8

The upstream stream may remain HTTP. The browser only receives the proxy URL over HTTPS, avoiding browser mixed-content blocking.

Request headers

The proxy supports an optional URL-encoded JSON headers query parameter for upstream headers such as Referer or a custom User-Agent.

Example JSON before URL encoding:

{"Referer":"https://source.example/","Origin":"https://source.example"}

Do not expose arbitrary header injection to untrusted users in production. Treat this proxy as an infrastructure endpoint and protect it with your own access controls/rate limits where appropriate.

Important security note

This service is an outbound URL proxy. An unrestricted public deployment can be abused as an open proxy or used to reach internal/private network resources. Before exposing it publicly, add an allowlist of permitted upstream domains or equivalent SSRF protections, plus rate limiting/authentication appropriate to your application.

License

MIT — see the original project license terms.