rays/ipx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 18 Wiki Activity

Keep media out of shared caches (#189)

Browse Source 
Played from ipodderx.sdf1.net, DeadAir's audio reached ipx as one request
with no Range header: Cloudflare caches by extension, deadair.mp3 has one,
and /media said nothing about caching, so Cloudflare fetched the whole file
and served ranges from its own copy, to anyone Access let in, without the
subscriber check (#129). /media/{id} has no extension and was never cached.
Cache-Control: private on every media response, the save included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Ray Slakinski
2026-10-11 13:23:27 +00:00
parent e5b9b0cfdb
commit 9648a79f3f
3 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
tests/ui/app.spec.js
View File

@@ -1791,12 +1791,16 @@ test('DeadAir is off until turned on for a show, then plays it shortened, with y
// Saved without its dead air too (#186): smaller than the original, named to say so.
const saved = await page.evaluate(async id => {
const [d, o] = await Promise.all([fetch(`/media/${id}/deadair`), fetch(`/media/${id}`)]);
return { status: d.status, name: d.headers.get('content-disposition'), size: (await d.arrayBuffer()).byteLength, full: (await o.arrayBuffer()).byteLength };
const [d, o, p] = await Promise.all([fetch(`/media/${id}/deadair`), fetch(`/media/${id}`), fetch(`/media/${id}/deadair.mp3`, { headers: { Range: 'bytes=0-99' } })]);
return { status: d.status, name: d.headers.get('content-disposition'), size: (await d.arrayBuffer()).byteLength, full: (await o.arrayBuffer()).byteLength,
// Kept out of shared caches, or Cloudflare serves its own copy to anyone (#189).
caching: [d, o, p].map(r => r.headers.get('cache-control')), piece: p.status };
}, (await entry()).enclosures[0].id);
expect(saved.status).toBe(200);
expect(saved.name).toContain('DeadAir');
expect(saved.size).toBeLessThan(saved.full);
expect(saved.caching).toEqual(['private', 'private', 'private']);
expect(saved.piece).toBe(206);
// Played through DeadAir's playlist (#181), by hls.js in Chromium, with the switch beside the
// speed pressed. The element's own src is then hls.js's blob: address.