Docs: the redirect-proxy rule applies to verified Hot Tub app clients only

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUYdCh2nCVsQYgJAT7gwSi
This commit is contained in:
Simon
2026-10-19 07:53:08 +00:00
parent 6c69b46395
commit 0aa8929f29

View File

@@ -26,7 +26,7 @@ These rules cut across every step below. They are intentionally grouped at the t
### Output Shape
- **Never put a redirecting URL in `formats[].url`**: the Hot Tub app cannot follow redirects there. Redirect proxies (`REDIRECT_PROXIES` in `src/proxy.rs`) are for `video.url`; `api.rs` moves such formats to `url` for verified app clients as a safety net.
- **Verified Hot Tub app clients cannot follow redirects in `formats[].url`.** Redirect proxies (`REDIRECT_PROXIES` in `src/proxy.rs`) are for `video.url` in the app response; `api.rs` moves such formats to `url` for verified app clients as a safety net. Other clients keep the redirect-proxy URLs in `formats`.
- Use `formats` for real media URLs (HLS, multi-quality, signed token), and keep `video.url` on a stable page URL. Never set `video.url` to a tokenized stream that needs a `Referer` to play — the `url` field has no header contract.
- If thumbnails need a `Referer` and the player has no per-thumb header mechanism, proxy them via `/proxy/<id>-thumb/...`. The same applies to manifests with relative URIs.
- Keep filter `id` values stable and machine-targeted. Display `title`s change; ids route.