Premium Feed Not Requiring Authentication

  • drc9000

    (@drc9000)


    6 years, 4 months ago

    Hi,

    We’ve been using Powerpress to serve a premium podcast for over a year, but have recently been having problems with authorisation.

    We noticed it had become possible to subscribe to the feed in any podcast app without being asked for authorisation.

    I asked our hosts, Cloudways, to implement this fix on the server: https://create.blubrry.com/resources/powerpress/advanced-tools-and-options/premium-podcasting-content/premium-podcasting-q/

    And that solved part of the problem, for example in Apple’s Podcasts app, which does now ask for authorisation.

    But it’s still possible to subscribe without being asked for authorisation in unsupported apps like Podbean, including the most recent episodes.

    Some apps don’t ask for authorisation, but only show old episodes, and will neither ask for authorisation or fetch new episodes.

    Additionally, the feed is showing up in Google Podcasts (despite us not adding it there), although that doesn’t include the most recent episodes.

    So it’s a bit of a mess, and any ideas about tidying things up would be very welcome!

    The current setup is subscriptions sold through Woocommerce + Groups, podcast episodes hosted at Amazon, Powerpress working on our website hosted at Cloudways.

    Sorry for only providing basic/general details, if there’s an off-forum way of doing it I can provide more specific links and info if necessary.

    Thanks in advance,

    Daniel.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Contributor Angelo Mandato

    (@amandato)

    6 years, 4 months ago

    Hello @drc9000,

    Thanks for using PowerPress!

    Password protected feeds are very complex, as you have noted, it requires your hosting service to allow the capability. It sounds like you are on the right path having your host try to solve the issue.

    If you can share links to your website we can look to see why the authentication works for some clients and not others. Without links for us to test there is not else we can do other than point you to our documentation which you’ve already linked to.

    Thanks,
    Angelo

    Thread Starter drc9000

    (@drc9000)

    6 years, 4 months ago

    Hi Angelo,

    Thanks for the reply and understood — I wasn’t sure whether to put the link here or contact another way.

    The feed we’re having trouble with is:

    https://www.thesquareball.net/feed/tsb-podcast-extra-ball/

    For further info, I can confirm it working well with Overcast, but as above, other clients are producing different errors — some like Podbean not-protected, others not updating for recent episodes, and a Podcast Addict Android user has sent us a screenshot of an ‘Unknown Host Exception’ error.

    Please let me know if you need any more information to work with, and many thanks in advance for your help.

    Plugin Contributor Angelo Mandato

    (@amandato)

    6 years, 4 months ago

    Hello @drc9000,

    Thanks for sharing the link! I was able to determine that you are using “CloudFlare”. This will be the source of your issues. CloudFlare will cache pages based on user agent. Once one user authenticates within that application, it is possible that other users who are using the same exact app (user agent string matches) will have access without authenticated for the duration that CloudFlare caches the page, in this case your feed.

    CloudFlare (and its arch enemy Encapsula) have a reputation for causing issues for podcasters. I highly suggest not using it for your podcast website. If you need it to deal with high levels of traffic, you may need to consider other hosting solutions. I will say though that the high performing WordPress hosting services out there should not require cloudflare. Our website hosting we provide exclusively for podcasters does not require CloudFlare, I believe this is also the case for similar services like WP Engine and Flywheel. I would suggest asking your web host if you have to use CloudFlare, and if you don’t have to simply turn off the option in CloudFlare to allow the traffic to directly go to your website.

    If ClouldFlare is there to deal with a previous DDOS attack, you may want to setup your podcast website on a subdomain, e.g. podcasts.thesquareball.net then make that podcasts.thesquareball.net not go through CloudFlare.

    Thanks,
    Angelo

    Thread Starter drc9000

    (@drc9000)

    6 years, 3 months ago

    Hi Angelo,

    Belated thanks for a really fast and useful response — this was much appreciated.

    We think we’ve solved Cloudflare’s intervention by using a rule so it ignores the feed address — we’re looking at options to avoid using Cloudflare entirely.

    We’re also weighing up alternative ways of authenticating the rss feed from Powerpress — we think we might be able to do it with an API key.

    I know that’s outside the scope of any support you can provide with this plugin, but if you have any observations on whether that’s likely to work, or cause untold disasters, I’d welcome your thoughts.

    But most of all thanks for the help already given.

    Daniel.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Premium Feed Not Requiring Authentication’ is closed to new replies.