Skip to main content

HTTP 403 Error

tip

In 2025, WhaleDown solved the bugs mentioned in this document by caching KEYs and supporting TLS fingerprinting.

If you continue to encounter HTTP 403 errors, please let us know.

Problem​

This error usually occurs when downloading m3u8 videos. HLS(m3u8) is a streaming protocol built on top of the HTTP(s) protocol. The HTTP 403 Forbidden error indicates that the server refuses to authorize the request.

The reason for the error can be summarized in the following situations. Some of these situations are fixable.

Solution​

1. Protected Keys​

Some video server extended the m3u8 protocol and used techniques such as dynamic tokens to protect keys. These keys are used to decrypt the downloaded video. Since keys are still transmitted over the network, WhaleDown still has a way to get keys.

In this case, please use WhaleDown to launch Google Chrome and browse the relevant page. WhaleDown will cache the keys according to their characteristics and pass them to the downloader.

info

Document Browser explains how to use Google Chrome with WhaleDown.

2. Dynamic Tokens​

Sometimes video servers use dynamic tokens to protect manifest(m3u8) files. At this point, the detector looked like this,

  • playlist-2.m3u8?token=DYNAMIC*PLAYLIST_TOKEN***2**
  • playlist-1.m3u8?token=DYNAMIC*PLAYLIST_TOKEN***1**
  • master.m3u8?token=MASTER_TOKEN

master.m3u8 contains links to playlist-1.m3u8 and playlist-2.m3u8. However, since dynamic tokens are used, the token in the link is already inconsistent with the one detected above. Downloading master.m3u8 directly will cause the server to return a 403 error.

In this case, download the detector playlist manifest at the top every time. Because it already contains the correct token.

3. DRM​

The use of DRM(Digital rights management) technology has further strengthened the protection of videos by the HLS(m3u8) protocol. Major tech companies are developing their own DRM technology.

For example, Apple developed FairPlay Streaming technology. The key used to decrypt the video is no longer transmitted through HTTP(s) protocol. As a result, WhaleDown can't get the key.

tip

Currently, WhaleDown already supports downloading videos using Widevine DRM protection technology.