Cloudflare caches DeadAir's audio, so its copy skips the subscriber check #189
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Seen 2026-10-11 13:18 UTC while an episode played through DeadAir from ipodderx.sdf1.net: ipx got one GET /media/1381923/deadair.mp3 with no Range header and answered 200 (trace 221980c9bf145a341e8891f2b0342a2a), where hls.js asks for ranges (six 206s in the browser test, and ipx answers a direct range request with 206). The address ends in .mp3, which Cloudflare caches by default when the response says nothing about caching, and /media responses say nothing: Cloudflare fetches the whole file and serves the ranges from its copy. So the file sits at Cloudflare's edge, and anyone Access lets in is served it without ipx checking they subscribe to the feed (#129). /media/{id} itself has no extension and has always had 206s. Fix: Cache-Control: private on media responses.
Fixed in
9648a79, deployed: /media/{id} and deadair.mp3 answer 206 with Cache-Control: private. A copy Cloudflare already holds may be served until it expires; purging /media/* clears it now.