The live-thumbnail and manual /start,/stop sidecar->mam-api calls hit the CSRF
guard (403 missing X-Requested-With). Match the working pattern in index.js:
send Authorization: Bearer $MAM_API_TOKEN (= CAPTURE_TOKEN, injected by
recorders.js), which is CSRF-exempt. Falls back to the UI header only when no
token is set (dev). Fixes [livethumb] failed ... 403 — posters now persist.
🤖 Generated with Claude Code
|
||
|---|---|---|
| .. | ||
| deltacast-bridge | ||
| sdk | ||
| src | ||
| .dockerignore | ||
| build-with-decklink.sh | ||
| decklink-sdk16.patch | ||
| Dockerfile | ||
| package.json | ||
| patch_decklink.py | ||