How to Configure HTTP Redirection in FFmpeg

When streaming or downloading media over HTTP, FFmpeg often encounters network redirects. This article explains how to configure HTTP request redirection options in FFmpeg, detailing the parameters used to control redirect behavior, safety, and protocols to ensure stable and secure media processing.

The -follow_redirects Option

By default, FFmpeg automatically follows HTTP redirects (status codes in the 3xx range). However, you can explicitly control this behavior using the -follow_redirects input option.

This option accepts the following values: * 1 or true: Forces FFmpeg to follow redirects. * 0 or false: Prevents FFmpeg from following redirects, causing the connection to stop or fail if a redirect is encountered. * -1 or auto: Allows FFmpeg to decide based on its default internal behavior.

To disable redirects when reading an input stream, place the option before the input file (-i):

ffmpeg -follow_redirects 0 -i http://example.com/stream.mp3 -c copy output.mp3

Security with -auth_other_headers

When a redirect sends FFmpeg to a different hostname, passing along custom headers (such as Authorization tokens) can pose a security risk. FFmpeg provides the -auth_other_headers option to mitigate this.

• 0 (Default): Custom headers are stripped when the redirect points to a different hostname, protecting your credentials.
• 1: Custom headers are preserved and sent to the redirected hostname.

If you are redirecting to a trusted external domain and must retain your authorization headers, configure your command like this:

ffmpeg -headers "Authorization: Bearer XYZ123" -auth_other_headers 1 -i http://example.com/source -c copy output.mp4

Controlling Redirection Protocol Types

FFmpeg also allows you to restrict the protocols allowed during redirects. The -protocol_whitelist option defines which protocols the demuxer can access. If an HTTP stream redirects to an unsupported protocol (such as shifting from HTTPS to an unencrypted or local protocol), FFmpeg will block it if it is not in the whitelist.

To restrict redirections to secure web protocols only:

ffmpeg -protocol_whitelist "file,crypto,tls,tcp,https" -i https://example.com/secure_stream.m3u8 -c copy output.mkv

By combining -follow_redirects, -auth_other_headers, and -protocol_whitelist, you can precisely control how FFmpeg handles network redirects for optimal security and reliability.