From 58d66fe06ddc6cdf5483b8bb77172c2734f3039c Mon Sep 17 00:00:00 2001 From: Shekhar Vaidya Date: Mon, 18 May 2026 12:58:07 +0530 Subject: [PATCH] docs: update README, About, Privacy and Disclaimer for CF Worker - README: add cloudflare-worker/ to project structure, update How It Works diagram to show CF Worker hop, add CF Worker setup instructions under Running Locally, and fix Deployment section (Worker is an outbound proxy, not the backend host) - About: mention CF Worker distributes requests across Cloudflare edge - Privacy: add Cloudflare as a third-party service, update date - Disclaimer: update date Co-Authored-By: Claude Sonnet 4.6 --- README.md | 37 +++++++++++++++++------- frontend/src/pages/AboutPage.tsx | 8 +++-- frontend/src/pages/DisclaimerPage.tsx | 2 +- frontend/src/pages/PrivacyPolicyPage.tsx | 16 +++++++++- 4 files changed, 48 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 171317c..6191d3a 100644 --- a/README.md +++ b/README.md @@ -37,8 +37,9 @@ MSDL replicates the session flow that Microsoft uses to serve ISO download links ``` windows-iso-downloader/ -├── frontend/ # React 19 + TypeScript + Vite + Tailwind v4 -├── backend/ # Go proxy server (recommended for production) +├── frontend/ # React 19 + TypeScript + Vite + Tailwind v4 +├── backend/ # Go proxy server (recommended for production) +├── cloudflare-worker/ # Optional CF Worker for distributed IP routing └── README.md ``` @@ -47,16 +48,18 @@ windows-iso-downloader/ ## How It Works ``` -Browser → Backend Proxy → Microsoft Download API → Signed CDN URL - ↓ - 1. Register session (Microsoft tracking endpoint) - 2. Parse MDT fingerprint script - 3. Fetch SKU list (available languages) - 4. Fetch signed CDN download URL +Browser → Backend → (CF Worker) → Microsoft API → Signed CDN URL + ↓ + 1. Register session (Microsoft tracking endpoint) + 2. Parse MDT fingerprint script + 3. Fetch SKU list (available languages) + 4. Fetch signed CDN download URL ``` The flow mirrors [Fido.ps1](https://github.com/pbatard/Fido) by Pete Batard — the same script bundled with Rufus. +Outbound requests to Microsoft are optionally routed through a Cloudflare Worker (`cloudflare-worker/worker.js`). This distributes requests across Cloudflare's global edge IPs instead of a single server IP, preventing Microsoft's rate-limit block (error 715-123130) under high traffic. The Worker is opt-in via environment variables — omit them to go direct to Microsoft. + --- ## Running Locally @@ -84,6 +87,17 @@ Create `frontend/.env.local`: VITE_API_URL=http://localhost:3002 ``` +#### Optional: Cloudflare Worker (recommended for production) + +Deploy `cloudflare-worker/worker.js` to Cloudflare Workers, then set these on the backend: + +```env +CF_WORKER_URL=https://your-worker.your-name.workers.dev +CF_WORKER_SECRET=your-secret # must match the CF_WORKER_SECRET secret set in the Worker's settings +``` + +Omit both to go direct to Microsoft (fine for local development and low-traffic self-hosting). + --- ## API Reference @@ -167,14 +181,15 @@ Returns signed download links from Microsoft's CDN. ## Deployment -> ⚠️ **Deploy the backend to a standard VPS** (Hetzner, DigitalOcean, Linode, etc.) — **not** serverless platforms like Vercel, Cloudflare Workers, or AWS Lambda. Microsoft rate-limits known datacenter IP ranges. - Recommended setup: | Component | Platform | |---|---| | Frontend | Cloudflare Pages / Vercel (static) | -| Backend | VPS with a non-datacenter IP | +| Backend | VPS (Hetzner, DigitalOcean, Linode, etc.) | +| Outbound proxy | Cloudflare Worker (optional, recommended for public instances) | + +> ⚠️ **Deploy the Go backend to a standard VPS**, not serverless platforms. The Cloudflare Worker is used only as an outbound proxy for Microsoft API calls — the backend itself must be a long-running process with session state. --- diff --git a/frontend/src/pages/AboutPage.tsx b/frontend/src/pages/AboutPage.tsx index cc8a6a4..9d84dbc 100644 --- a/frontend/src/pages/AboutPage.tsx +++ b/frontend/src/pages/AboutPage.tsx @@ -67,8 +67,12 @@ export default function AboutPage() {
  • Call the download links API using the warmed session to get signed CDN URLs

    • - Links are IP-tied to the server and expire after 24 hours — this is standard - Microsoft behaviour, not a limitation of MSDL. + Outbound requests to Microsoft are routed through a Cloudflare Worker, which + distributes traffic across Cloudflare's global edge IPs. This prevents any single + IP from being rate-limited by Microsoft under high traffic. +

    +

    + Links expire after 24 hours — this is standard Microsoft behaviour, not a limitation of MSDL.

    diff --git a/frontend/src/pages/DisclaimerPage.tsx b/frontend/src/pages/DisclaimerPage.tsx index 263d91b..60db64c 100644 --- a/frontend/src/pages/DisclaimerPage.tsx +++ b/frontend/src/pages/DisclaimerPage.tsx @@ -30,7 +30,7 @@ export default function DisclaimerPage() { >

    Disclaimer

    -

    Last updated: April 9, 2026

    +

    Last updated: May 18, 2026

    diff --git a/frontend/src/pages/PrivacyPolicyPage.tsx b/frontend/src/pages/PrivacyPolicyPage.tsx index 4912218..d588c02 100644 --- a/frontend/src/pages/PrivacyPolicyPage.tsx +++ b/frontend/src/pages/PrivacyPolicyPage.tsx @@ -30,7 +30,7 @@ export default function PrivacyPolicyPage() { >

    Privacy Policy

    -

    Last updated: April 9, 2026

    +

    Last updated: May 18, 2026

    @@ -60,6 +60,20 @@ export default function PrivacyPolicyPage() { (software.download.prss.microsoft.com). We are not responsible for Microsoft's privacy practices or link availability.

    +

    + API requests to Microsoft are routed through a Cloudflare Worker running on + Cloudflare's edge network. Cloudflare may process request metadata in transit + in accordance with their{' '} + + privacy policy + . + No user data or download links are stored by the Worker. +