k/downloadwf
1
Fork 0
Code Releases Activity

UPDATED

Browse Source
This commit is contained in:
Anaïs Saraiva
2026-08-15 00:35:22 +02:00
parent 954384d1e4
commit d8b9fbe993
8 changed files with 578 additions and 388 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HOSTING.md
+1 -1
View File
@@ -241,7 +241,7 @@ Files in `storage/` are untouched by updates and keep working.
- The app binds to loopback; only the proxy is exposed.
- Download/deletion require the unguessable key; everything else is `404`.
- Optional per-file passwords are stored only as scrypt hashes; entry mints a
- Every file requires a password, stored only as an scrypt hash; entry mints a
short-lived HMAC-signed cookie (server secret in `storage/.secret`).
- Rate limiting protects the keyed endpoints; `TRUST_PROXY=1` must only be set
when a proxy really sets `X-Forwarded-For`/`CF-Connecting-IP`.