7fc718158a
The proxy exists to get around CORS, hotlink protection and TLS fingerprinting, so the player probes whether a CDN will serve the browser itself and skips the hop when it will. The probe took a readable status line and some bytes as proof. Not every hotlink guard refuses a foreign Referer with a 403. eporner's CDN answers one with a 302 to a one-minute "watch this at our site instead" clip, served 206 with Access-Control-Allow-Origin: *. fetch() follows that redirect without comment, so the probe read the stand-in as a win, cached the host as direct, and the player restarted playback on the raw URL -- where the browser sent the page's own Referer again and got the stand-in a second time. An eporner video played as 61 seconds of advertisement instead of itself. Only the resolved path was affected: yt-dlp's eporner formats carry no Referer, so refererRequired was false and the race ran. The listing's own formats name one and were always proxied. So ask the proxy, which carries the Referer the origin wants, how long the media is, and refuse a direct route that reports another length. The question goes out alongside the direct fetch rather than after it, and an unknown length on either side leaves the old bytes test standing, so chunked responses and playlists decide as before. No Range header: that would cost a CORS preflight. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MPZFnNdHbPGDTqQUNiE4ZN