Media responses carried Laravel session cookies (Set-Cookie), which made
Cloudflare BYPASS the cache for every cover/avatar/banner. These are public
files with no user context, so the session/cookie/CSRF chain is unnecessary.
Also skips BotDetector (one analytics_bot_logs INSERT per image) and the SEO
redirect lookup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Resolve hosts to IPs and reject private/reserved/link-local ranges (incl.
169.254 cloud metadata) instead of matching hostname text, and re-validate
every redirect hop by following them manually. Restrict curl to http(s).
vtt-proxy allowlist now requires an exact host or a real subdomain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ayrisdevandClaude Opus 4.8