Thanks for reading. Of the three you list, it was closest to the cookie domain problem: because the CDN domain differs from the app domain, browsers that block third-party cookies by default silently failed to authenticate against the CDN, with no error beyond "video won't play." The fix was a tested fallback that appends a signed token to the manifest/segment requests for those sessions. I didn't cover CORS or cache keys in the write-up, so I can't speak to those from this migration.

Thanks for the follow-up — the CDN domain ≠ app domain third-party cookie block is exactly the silent failure mode that looks like a player bug. Signed tokens on the manifest/segments as a fallback makes sense. In your migration, did you keep tokens only for sessions where cookies were blocked, or did you eventually move everyone to tokenized URLs? And how did you align token expiry/rotation with playlist refresh so mid-stream renewals didn’t stall playback?

We've been building an open-source CDN control plane (CDNCA) around the same class of edge auth/ops problems; marketplace features roll out release by release. Install packages are still coming, so we point people at the site and repo README rather than paste commands here.