...

HLS authentication setting can be changed without server restart. In this case hls_auth_enabled affects existing subscribers and hls_auth_token_cache affects new subscribers only.

Unauthorized access to HLS segments prevention

To decrease server load, authentication token and stream availability in CDN are checked on HLS playlist request. The following parameter is added since build 5.2.436 to protect separate HLS segments

hls_segment_name_suffix_randomizer_enabled=true

In this case, randomly generated suffix is added to every segment file name, for example

test16d2da4658f4374953a120f3c95bc715ea.ts

So, brute force iteration over segments is escaped.

Note that suffix is not added to preloader segments.

Adding cross-domain access control HTTP headers for HLS playback

...