shekhar/windows-iso-downloader
1
0
Fork 0
Code Issues Pull requests Projects Releases 15 Packages Wiki Activity Actions

docs: update README, About, Privacy and Disclaimer for CF Worker

Browse source 
- README: add cloudflare-worker/ to project structure, update How It
  Works diagram to show CF Worker hop, add CF Worker setup instructions
  under Running Locally, and fix Deployment section (Worker is an
  outbound proxy, not the backend host)
- About: mention CF Worker distributes requests across Cloudflare edge
- Privacy: add Cloudflare as a third-party service, update date
- Disclaimer: update date

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Shekhar Vaidya 2026-05-18 12:58:07 +05:30
parent 106e2e2b31
commit 58d66fe06d
4 changed files with 48 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
README.md
View file

@ -37,8 +37,9 @@ MSDL replicates the session flow that Microsoft uses to serve ISO download links
```
windows-iso-downloader/
├── frontend/ # React 19 + TypeScript + Vite + Tailwind v4
├── backend/ # Go proxy server (recommended for production)
├── frontend/ # React 19 + TypeScript + Vite + Tailwind v4
├── backend/ # Go proxy server (recommended for production)
├── cloudflare-worker/ # Optional CF Worker for distributed IP routing
└── README.md
```
@ -47,16 +48,18 @@ windows-iso-downloader/
## How It Works
```
Browser → Backend Proxy → Microsoft Download API → Signed CDN URL
↓
1. Register session (Microsoft tracking endpoint)
2. Parse MDT fingerprint script
3. Fetch SKU list (available languages)
4. Fetch signed CDN download URL
Browser → Backend → (CF Worker) → Microsoft API → Signed CDN URL
↓
1. Register session (Microsoft tracking endpoint)
2. Parse MDT fingerprint script
3. Fetch SKU list (available languages)
4. Fetch signed CDN download URL
```
The flow mirrors [Fido.ps1](https://github.com/pbatard/Fido) by Pete Batard — the same script bundled with Rufus.
Outbound requests to Microsoft are optionally routed through a Cloudflare Worker (`cloudflare-worker/worker.js`). This distributes requests across Cloudflare's global edge IPs instead of a single server IP, preventing Microsoft's rate-limit block (error 715-123130) under high traffic. The Worker is opt-in via environment variables — omit them to go direct to Microsoft.
---
## Running Locally
@ -84,6 +87,17 @@ Create `frontend/.env.local`:
VITE_API_URL=http://localhost:3002
```
#### Optional: Cloudflare Worker (recommended for production)
Deploy `cloudflare-worker/worker.js` to Cloudflare Workers, then set these on the backend:
```env
CF_WORKER_URL=https://your-worker.your-name.workers.dev
CF_WORKER_SECRET=your-secret # must match the CF_WORKER_SECRET secret set in the Worker's settings
```
Omit both to go direct to Microsoft (fine for local development and low-traffic self-hosting).
---
## API Reference
@ -167,14 +181,15 @@ Returns signed download links from Microsoft's CDN.
## Deployment
> ⚠️ **Deploy the backend to a standard VPS** (Hetzner, DigitalOcean, Linode, etc.) — **not** serverless platforms like Vercel, Cloudflare Workers, or AWS Lambda. Microsoft rate-limits known datacenter IP ranges.
Recommended setup:
| Component | Platform |
|---|---|
| Frontend | Cloudflare Pages / Vercel (static) |
| Backend | VPS with a non-datacenter IP |
| Backend | VPS (Hetzner, DigitalOcean, Linode, etc.) |
| Outbound proxy | Cloudflare Worker (optional, recommended for public instances) |
> ⚠️ **Deploy the Go backend to a standard VPS**, not serverless platforms. The Cloudflare Worker is used only as an outbound proxy for Microsoft API calls — the backend itself must be a long-running process with session state.
---

8
frontend/src/pages/AboutPage.tsx
View file

@ -67,8 +67,12 @@ export default function AboutPage() {
<li>Call the download links API using the warmed session to get signed CDN URLs</li>
</ol>
<p>
Links are IP-tied to the server and expire after 24 hours — this is standard
Microsoft behaviour, not a limitation of MSDL.
Outbound requests to Microsoft are routed through a Cloudflare Worker, which
distributes traffic across Cloudflare's global edge IPs. This prevents any single
IP from being rate-limited by Microsoft under high traffic.
</p>
<p>
Links expire after 24 hours — this is standard Microsoft behaviour, not a limitation of MSDL.
</p>
</Section>

2
frontend/src/pages/DisclaimerPage.tsx
View file

@ -30,7 +30,7 @@ export default function DisclaimerPage() {
>
<div>
<h1 className="text-2xl font-bold text-white mb-1">Disclaimer</h1>
<p className="text-xs font-mono text-zinc-600">Last updated: April 9, 2026</p>
<p className="text-xs font-mono text-zinc-600">Last updated: May 18, 2026</p>
</div>
<div className="p-4 rounded-xl border border-amber-500/15 bg-amber-500/6 text-amber-400/80 text-[12px] leading-relaxed">

16
frontend/src/pages/PrivacyPolicyPage.tsx
View file

@ -30,7 +30,7 @@ export default function PrivacyPolicyPage() {
>
<div>
<h1 className="text-2xl font-bold text-white mb-1">Privacy Policy</h1>
<p className="text-xs font-mono text-zinc-600">Last updated: April 9, 2026</p>
<p className="text-xs font-mono text-zinc-600">Last updated: May 18, 2026</p>
</div>
<Section title="No data collected">
@ -60,6 +60,20 @@ export default function PrivacyPolicyPage() {
(<code className="text-zinc-400 text-[11px] font-mono bg-white/5 px-1 py-0.5 rounded">software.download.prss.microsoft.com</code>).
We are not responsible for Microsoft's privacy practices or link availability.
</p>
<p>
API requests to Microsoft are routed through a Cloudflare Worker running on
Cloudflare's edge network. Cloudflare may process request metadata in transit
in accordance with their{' '}
<a
href="https://www.cloudflare.com/privacypolicy/"
target="_blank"
rel="noopener noreferrer"
className="text-blue-400 hover:text-blue-300 transition-colors"
>
privacy policy
</a>.
No user data or download links are stored by the Worker.
</p>
</Section>
<Section title="Open source">