Downloading a video from the url returns soft 401 html page

Description/Error
When an account has Share cloud recordings only with members of my account enabled and you try to download without an access token, the url returns an html page with response code 200, and some text in the middle of the page that says No permission (200). This is very unhelpful if you are trying to do this in code. The server should return a 401 response, even if it does return an html page. This will at least tell you what is going on if you are running this in code.

Example url: https://zoom.us/recording/download/<reallylongstringofnumbers/letters>

How To Reproduce (If applicable)
Steps to reproduce the behavior:

  1. Get a download url for a meeting where Share cloud recordings only with members of my account is enabled on the account.
  2. Paste the url into a browser where you are not logged in to zoom.
  3. See the html response & status code is 200

Screenshots (If applicable)
If applicable, add screenshots to help explain your problem.

image

Thanks for the post @zoom-test,

We will work on fixing that error page.

In the meantime, to download private / password protected cloud recordings, follow these steps:

Thanks,
Tommy

Thanks for the reply @tommy

1 Like

Happy to help! :slight_smile:

Thanks,
Tommy

@tommy

I came across another instance of this. If cloud downloads are completely disabled or IP restricted then even using the download token you get a soft 401 page as well. The page returns a 200 but shows an error on the page as text saying that downloads are disabled or some other message.

Either of these two (download disabled or IP Address Control set to certain IP’s only):

Hey @zoom-test,

This is intended functionality if those two settings are enabled.

Thanks,
Tommy

Thanks @tommy for your response.

I understand that is the intended functionality. What is very unhelpful about this (as in my first post on this topic at the top of the page), is that these pages return response code 200 which means OK. You are expecting to download an mp4 file but instead get an html webpage, that is not helpful.

Even if it returns the html page, the response code should match the type of response. So if I am unauthorized (ie. lacking valid credentials of any sort) it should return a 401. If I don’t have the proper level of authorization then 403 (forbidden) is appropriate. An example: https://leastprivilege.com/2014/10/02/401-vs-403/

Since the download links behave this way (return 200 OK for everything) it forces the users of the zoom api to take a lot more extra steps to verify that they actually downloaded a valid mp4 file vs. not. I can’t just trust that it is correct if it gives me a 200 OK.

This is why I posted about this and as of October you said the team will work on fixing the error page.

Thanks!

Hey @zoom-test,

I fully agree with you. We are working on improving the status codes. (ZOOM-132992)

Thanks,
Tommy

Hey @zoom-test,

Can you please supply the full request url? We are looking into fixing this. Feel free to private message it to me.

Thanks,
Tommy

Just sent you an example.

Thanks @zoom-test!

We will take a look!

-Tommy

Hey @zoom-test,

After discussion with our engineers, we have added this as a feature request.

In the meantime, I suggest implementing logic to handle the html response when the user is not logged in.

Thanks,
Tommy

Thanks @tommy. I actually just implemented this the other day. We just download the first 1000 bytes or so and check for an <html> tag.

1 Like

Great work around! :slight_smile:

Thanks,
Tommy