Sentinel started rejecting all /proxy requests because cookies set during
the fingerprinting flow (vlscppe/ov-df) were never reaching the
GetProductDownloadLinksBySku call.
Two gaps closed:
- CF Worker now forwards Cookie header to Microsoft and Set-Cookie headers
back to the backend
- Backend uses a simpleCookieJar (domain-scoping disabled) shared across
the full session: setup → warmup → download link fetch. Standard
cookiejar rejects microsoft.com cookies when the request URL is the
Worker domain.
Tested locally without Worker (direct MS calls): download links returned,
no Sentinel error.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add cloudflare-worker/worker.js: edge proxy forwarding requests to allowed
Microsoft hosts from Cloudflare distributed IPs. Set CF_WORKER_URL env var
to activate; omit to keep direct-to-Microsoft behaviour (self-hosters unaffected).
- Wrap all outbound Microsoft URLs in proxyURL() in main.go so the Worker
sits transparently in front of every session and download-link request.
- Fix Back button navigating to external referrer when user lands directly
on a product URL (#5) — use window.history.state?.idx to detect whether
there is prior in-app history before calling navigate(-1).
Closes#5, Closes#6
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
