Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/globo.py (Python)

Code before:
        video_id = self._match_id(url)

        self._download_webpage('https://globo-ab.globo.com/v2/selected-alternatives?experiments=player-isolated-experiment-02&skipImpressions=true', video_id, 'Getting cookies')

        video = self._download_json(
            'http://api.globovideos.com/videos/%s/playlist' % video_id,
            video_id)['videos'][0]
        if not self.get_param('allow_unplayable_formats') and video.get('encrypted') is True:
            self.report_drm(video_id)

        title = video['title']

        formats = []
        security = self._download_json(
            'https://playback.video.globo.com/v2/video-session', video_id, 'Downloading security hash for %s' % video_id,
            headers={'content-type': 'application/json'}, data=json.dumps({
                "player_type": "desktop",
                "video_id": video_id,
                "quality": "max",
                "content_protection": "widevine",
                "vsid": "581b986b-4c40-71f0-5a58-803e579d5fa2",
                "tz": "-3.0:00"
            }).encode())

        manifest = security['sources'][0]['url_template']
        self._download_webpage(manifest, video_id, 'Getting locksession cookie')

        security_hash = security['sources'][0]['token']
        if not security_hash:
            message = security.get('message')
            if message:
                raise ExtractorError(
                    '%s returned error: %s' % (self.IE_NAME, message), expected=True)

        hash_code = security_hash[:2]
        padding = '%010d' % random.randint(1, 10000000000)
        if hash_code in ('04', '14'):
            received_time = security_hash[3:13]
            received_md5 = security_hash[24:]
            hash_prefix = security_hash[:23]
        elif hash_code in ('02', '12', '03', '13'):
            received_time = security_hash[2:12]
            received_md5 = security_hash[22:]
            padding += '1'
            hash_prefix = '05' + security_hash[:22]

        padded_sign_time = compat_str(int(received_time) + 86400) + padding
        md5_data = (received_md5 + padded_sign_time + '0xAC10FD').encode()
        signed_md5 = base64.urlsafe_b64encode(hashlib.md5(md5_data).digest()).decode().strip('=')
        signed_hash = hash_prefix + padded_sign_time + signed_md5
        source = security['sources'][0]['url_parts']

Review comment (security):
```suggestion
        self._request_webpage(HeadRequest(security['sources'][0]['url_template']), video_id, 'Getting locksession cookie')
```

Code after:
    def _real_extract(self, url):
        video_id = self._match_id(url)

        self._request_webpage(
            HEADRequest('https://globo-ab.globo.com/v2/selected-alternatives?experiments=player-isolated-experiment-02&skipImpressions=true'),
            video_id, 'Getting cookies')

        video = self._download_json(
            'http://api.globovideos.com/videos/%s/playlist' % video_id,
            video_id)['videos'][0]
        if not self.get_param('allow_unplayable_formats') and video.get('encrypted') is True:
            self.report_drm(video_id)

        title = video['title']

        formats = []
        security = self._download_json(
            'https://playback.video.globo.com/v2/video-session', video_id, 'Downloading security hash for %s' % video_id,
            headers={'content-type': 'application/json'}, data=json.dumps({
                "player_type": "desktop",
                "video_id": video_id,
                "quality": "max",
                "content_protection": "widevine",
                "vsid": "581b986b-4c40-71f0-5a58-803e579d5fa2",
                "tz": "-3.0:00"
            }).encode())

        self._request_webpage(HEADRequest(security['sources'][0]['url_template']), video_id, 'Getting locksession cookie')

        security_hash = security['sources'][0]['token']
        if not security_hash:
            message = security.get('message')
            if message:
                raise ExtractorError(
                    '%s returned error: %s' % (self.IE_NAME, message), expected=True)

        hash_code = security_hash[:2]
        padding = '%010d' % random.randint(1, 10000000000)
        if hash_code in ('04', '14'):
            received_time = security_hash[3:13]
            received_md5 = security_hash[24:]
            hash_prefix = security_hash[:23]
        elif hash_code in ('02', '12', '03', '13'):
            received_time = security_hash[2:12]
            received_md5 = security_hash[22:]
            padding += '1'
            hash_prefix = '05' + security_hash[:22]

        padded_sign_time = compat_str(int(received_time) + 86400) + padding
        md5_data = (received_md5 + padded_sign_time + '0xAC10FD').encode()
        signed_md5 = base64.urlsafe_b64encode(hashlib.md5(md5_data).digest()).decode().strip('=')