k/downloadwf
1
Fork 0
Code Releases Activity

optional password

Browse Source
This commit is contained in:
Anaïs Saraiva
2026-08-15 10:42:20 +02:00
parent 12d9e99aa2
commit 6e76189e46
7 changed files with 50 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HOSTING.md
+2 -1
View File
@@ -244,8 +244,9 @@ Files in `storage/` are untouched by updates and keep working.
- The app binds to loopback; only the proxy is exposed.
- Download/deletion require the unguessable key; everything else is `404`.
- Every file requires a password, stored only as an scrypt hash; entry mints a
- Files uploaded with a password store only its scrypt hash; entry mints a
short-lived HMAC-signed cookie (server secret in `storage/.secret`).
Password-less files stream immediately to anyone with the key.
- Rate limiting protects the keyed endpoints; `TRUST_PROXY=1` must only be set
when a proxy really sets `X-Forwarded-For`/`CF-Connecting-IP`.
- Files auto-expire after 48 hours (configurable via `FILE_TTL_MS`, hard-capped