Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/espn.py (Python)

Code before:
                    'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange'
                })['access_token']

            assertion = self._call_bamgrid_api(
                'accounts/grant', video_id, payload={'id_token': id_token},
                headers={
                    'Authorization': token,
                    'Content-Type': 'application/json; charset=UTF-8'
                })['assertion']

            token = self._call_bamgrid_api(
                'token', video_id, payload={
                    'subject_token': assertion,
                    'subject_token_type': 'urn:bamtech:params:oauth:token-type:account',
                    'platform': 'android',
                    'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange'
                })['access_token']

            playback = self._download_json(
                video_data['videoHref'].format(scenario='browser~ssai'), video_id,
                headers={
                    'Accept': 'application/vnd.media-service+json; version=5',
                    'Authorization': token
                })

            m3u8_url, m3u8_headers = playback['stream']['complete'][0]['url'], {'authorization': token}

        # TV Provider required
        else:
            resource = self._get_mvpd_resource('ESPN', title, video_id, None)
            auth = self._extract_mvpd_auth(url, video_id, 'ESPN', resource).encode('utf-8')

            asset = self._download_json(
                'https://watch.auth.api.espn.com/video/auth/media/%s/asset?apikey=uiqlbgzdwuru14v627vdusswb' % video_id,
                video_id, data=(
                    'adobeToken=%s&drmSupport=HLS' % urllib.parse.quote_plus(base64.b64encode(auth))).encode())
            m3u8_url, m3u8_headers = asset['stream'], {}

        formats = self._extract_m3u8_formats(
            m3u8_url, video_id, 'mp4', entry_protocol='m3u8_native', m3u8_id='hls')
        self._sort_formats(formats)

        return {
            'id': video_id,
            'title': title,
            'formats': formats,
            'http_headers': m3u8_headers,
            'thumbnail': video_data.get('posterHref')
        }


Review comment (security):
```suggestion
            m3u8_url, headers = playback['stream']['complete'][0]['url'], {'authorization': token}
```

Code after:
                    'Authorization': token,
                    'Content-Type': 'application/json; charset=UTF-8'
                })['assertion']
            token = self._call_bamgrid_api(
                'token', video_id, payload={
                    'subject_token': assertion,
                    'subject_token_type': 'urn:bamtech:params:oauth:token-type:account',
                    'platform': 'android',
                    'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange'
                })['access_token']

            playback = self._download_json(
                video_data['videoHref'].format(scenario='browser~ssai'), video_id,
                headers={
                    'Accept': 'application/vnd.media-service+json; version=5',
                    'Authorization': token
                })
            m3u8_url, headers = playback['stream']['complete'][0]['url'], {'authorization': token}

        # TV Provider required
        else:
            resource = self._get_mvpd_resource('ESPN', video_data['name'], video_id, None)
            auth = self._extract_mvpd_auth(url, video_id, 'ESPN', resource).encode()

            asset = self._download_json(
                f'https://watch.auth.api.espn.com/video/auth/media/{video_id}/asset?apikey=uiqlbgzdwuru14v627vdusswb',
                video_id, data=f'adobeToken={urllib.parse.quote_plus(base64.b64encode(auth))}&drmSupport=HLS'.encode())
            m3u8_url, headers = asset['stream'], {}

        formats, subtitles = self._extract_m3u8_formats_and_subtitles(m3u8_url, video_id, 'mp4', m3u8_id='hls')
        self._sort_formats(formats)

        return {
            'id': video_id,
            'title': video_data.get('name'),
            'formats': formats,
            'subtitles': subtitles,
            'thumbnail': video_data.get('posterHref'),
            'http_headers': headers,
        }