shekhar/windows-iso-downloader

Fork 0

feat: Cloudflare Worker proxy for Microsoft API + Back button fix + favicon #7

Merged

starkSV merged 1 commit from feat/cf-worker-proxy into main

2026-05-18 12:07:42 +05:30

starkSV commented

2026-05-18 12:06:52 +05:30

(Migrated from github.com)

Changes

fix: Back button navigates to external referrer (#5)

When users land directly on a product URL from an external source, the
Back button now always returns to the home page instead of the external
referrer. Uses window.history.state?.idx to detect whether prior
in-app history exists before calling navigate(-1).

feat: Cloudflare Worker proxy to avoid Microsoft IP blocks (#6)

The Go backend now routes all Microsoft API calls through a Cloudflare
Worker (cloudflare-worker/worker.js) when CF_WORKER_URL is set.
Cloudflare's distributed edge IPs prevent any single IP from accumulating
enough request volume to trigger Microsoft's block (error 715-123130).

The Worker is protected by a shared secret (CF_WORKER_SECRET) so only
the backend can use it. Self-hosters can omit both env vars to keep the
existing direct-to-Microsoft behaviour.

Required env vars on the backend:

CF_WORKER_URL — your deployed Worker URL
CF_WORKER_SECRET — must match the secret set in the Worker's settings

fix: Add favicon

Closes #5, Closes #6

Summary by CodeRabbit

Bug Fixes
- Fixed "Back" button navigation in the product detail page to correctly preserve browser history state.

## Changes ### fix: Back button navigates to external referrer (#5) When users land directly on a product URL from an external source, the Back button now always returns to the home page instead of the external referrer. Uses `window.history.state?.idx` to detect whether prior in-app history exists before calling `navigate(-1)`. ### feat: Cloudflare Worker proxy to avoid Microsoft IP blocks (#6) The Go backend now routes all Microsoft API calls through a Cloudflare Worker (`cloudflare-worker/worker.js`) when `CF_WORKER_URL` is set. Cloudflare's distributed edge IPs prevent any single IP from accumulating enough request volume to trigger Microsoft's block (error 715-123130). The Worker is protected by a shared secret (`CF_WORKER_SECRET`) so only the backend can use it. Self-hosters can omit both env vars to keep the existing direct-to-Microsoft behaviour. **Required env vars on the backend:** - `CF_WORKER_URL` — your deployed Worker URL - `CF_WORKER_SECRET` — must match the secret set in the Worker's settings ### fix: Add favicon Closes #5, Closes #6  ## Summary by CodeRabbit * **Bug Fixes** * Fixed "Back" button navigation in the product detail page to correctly preserve browser history state.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/starkSV/windows-iso-downloader/pull/7?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

coderabbitai[bot] commented

2026-05-18 12:07:02 +05:30

(Migrated from github.com)

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c70f498-232c-4963-9994-e618225d8165

📥 Commits

Reviewing files that changed from the base of the PR and between a8f9ba1da1 and 8b036e94ba.

⛔ Files ignored due to path filters (1)

frontend/public/favicon.ico is excluded by !**/*.ico

📒 Files selected for processing (3)

backend/main.go
cloudflare-worker/worker.js
frontend/src/pages/ProductDetailPage.tsx

📝 Walkthrough

Walkthrough

PR adds Cloudflare Worker proxy routing for Microsoft API calls to distribute outbound traffic across edge IPs instead of a single server IP, preventing rate-limiting blocks. Backend imports os, defines proxy helpers (setWorkerSecret, proxyURL), and applies them to setupSession, /skuinfo, and /proxy handlers. New Cloudflare Worker validates secret headers and forwards allowed hosts. Frontend back button now falls back to home when no in-app history exists.

Changes

Cloudflare Worker Proxy Infrastructure

Layer / File(s)	Summary
Worker environment and proxy helpers `backend/main.go`	Adds `os` import, reads `CF_WORKER_SECRET`, and defines `setWorkerSecret` function to conditionally set `X-Worker-Secret` header and `proxyURL` function to rewrite Microsoft URLs through `CF_WORKER_URL` with original hostname as `host` query parameter.
setupSession proxy integration `backend/main.go`	Updates setupSession steps 1-3 (tags, mdt.js, fingerprint) to use `proxyURL` for URL construction and apply `setWorkerSecret` to each request.
/skuinfo handler proxy integration `backend/main.go`	Modifies /skuinfo handler to build getskuinformationbyproductedition request URL via `proxyURL` and apply `setWorkerSecret` to outbound requests.
/proxy handler proxy integration `backend/main.go`	Updates /proxy handler warmup and main GetProductDownloadLinksBySku calls to use `proxyURL` and apply `setWorkerSecret`.
Cloudflare Worker reverse proxy `cloudflare-worker/worker.js`	Implements async fetch handler that validates `X-Worker-Secret` header, enforces allowlisted upstream hosts, rewrites URLs to remove host parameter, forwards method and headers, and returns response with CORS headers and Content-Type fallback.

Frontend Navigation Fix

Layer / File(s)	Summary
Back button fallback logic `frontend/src/pages/ProductDetailPage.tsx`	Changes back button to navigate to previous history entry when `window.history.state?.idx` is present, otherwise falls back to navigating to `/` instead of always using `navigate(-1)`.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

A Worker takes flight on Cloudflare's edge,
Spreading requests wide—no single IP pledge,
setupSession and skuinfo now proxy their way,
While the Back button knows the home-bound way! 🐰✨

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/cf-worker-proxy

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

> [!CAUTION] > ## Review failed > > The pull request is closed.  <details> <summary>ℹ️ Recent review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `4c70f498-232c-4963-9994-e618225d8165` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between a8f9ba1da1e17a5bd802bd37a3d380c819189095 and 8b036e94ba0236ea306407f8e95b1536fc0b9781. </details> <details> <summary>⛔ Files ignored due to path filters (1)</summary> * `frontend/public/favicon.ico` is excluded by `!**/*.ico` </details> <details> <summary>📒 Files selected for processing (3)</summary> * `backend/main.go` * `cloudflare-worker/worker.js` * `frontend/src/pages/ProductDetailPage.tsx` </details> </details> ---  <details> <summary>📝 Walkthrough</summary> ## Walkthrough PR adds Cloudflare Worker proxy routing for Microsoft API calls to distribute outbound traffic across edge IPs instead of a single server IP, preventing rate-limiting blocks. Backend imports `os`, defines proxy helpers (`setWorkerSecret`, `proxyURL`), and applies them to setupSession, /skuinfo, and /proxy handlers. New Cloudflare Worker validates secret headers and forwards allowed hosts. Frontend back button now falls back to home when no in-app history exists. ## Changes **Cloudflare Worker Proxy Infrastructure** | Layer / File(s) | Summary | | --- | --- | | **Worker environment and proxy helpers** `backend/main.go` | Adds `os` import, reads `CF_WORKER_SECRET`, and defines `setWorkerSecret` function to conditionally set `X-Worker-Secret` header and `proxyURL` function to rewrite Microsoft URLs through `CF_WORKER_URL` with original hostname as `host` query parameter. | | **setupSession proxy integration** `backend/main.go` | Updates setupSession steps 1-3 (tags, mdt.js, fingerprint) to use `proxyURL` for URL construction and apply `setWorkerSecret` to each request. | | **/skuinfo handler proxy integration** `backend/main.go` | Modifies /skuinfo handler to build getskuinformationbyproductedition request URL via `proxyURL` and apply `setWorkerSecret` to outbound requests. | | **/proxy handler proxy integration** `backend/main.go` | Updates /proxy handler warmup and main GetProductDownloadLinksBySku calls to use `proxyURL` and apply `setWorkerSecret`. | | **Cloudflare Worker reverse proxy** `cloudflare-worker/worker.js` | Implements async fetch handler that validates `X-Worker-Secret` header, enforces allowlisted upstream hosts, rewrites URLs to remove host parameter, forwards method and headers, and returns response with CORS headers and Content-Type fallback. | **Frontend Navigation Fix** | Layer / File(s) | Summary | | --- | --- | | **Back button fallback logic** `frontend/src/pages/ProductDetailPage.tsx` | Changes back button to navigate to previous history entry when `window.history.state?.idx` is present, otherwise falls back to navigating to `/` instead of always using `navigate(-1)`. | ## Estimated code review effort 🎯 3 (Moderate) | ⏱️ ~25 minutes ## Poem > A Worker takes flight on Cloudflare's edge, > Spreading requests wide—no single IP pledge, > setupSession and skuinfo now proxy their way, > While the Back button knows the home-bound way! 🐰✨ </details>   <details> <summary>✨ Finishing Touches</summary> <details> <summary>📝 Generate docstrings</summary> - [ ]  Create stacked PR - [ ]  Commit on current branch </details> <details> <summary>🧪 Generate unit tests (beta)</summary> - [ ]  Create PR with unit tests - [ ]  Commit unit tests in branch `feat/cf-worker-proxy` </details> </details>   > [!WARNING] > There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. > > <details> > <summary>🔧 golangci-lint (2.12.2)</summary> > > level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies" > > > > > </details>   --- Comment `@coderabbitai help` to get the list of available commands and usage tips.