Cloudflare Content Proxy

Features

• Proxy requests to a target URL with headers
• Proxy subrequests in m3u8
• Optional JWT authentication (enabled via config)
• Country blocking, CORS, and optional cache control
• Serverside DRM protected .mpd decryption

Known Issues

• Caching with HLS livestreams will break the livestream
  • Caching can also break a number of other things, pass cache=false as a parameter if a page has dynamic content.

Setup

1. Install dependencies

npm install

2. Configure environment variables

Edit wrangler.toml to set non-secret variables:

[vars]
BLOCKED_COUNTRY_CODES = ""           # Comma-separated country codes to block (e.g., "KP,IR,SY")
CACHE_NAME = "proxy-cache-v1"
CACHE_TTL_SECONDS = "3600"
CACHE_MIME_TYPES = "text/html,audio/mpeg,video/mp4,video/mp2t,application/vnd.apple.mpegurl,text/vtt,audio/aac,image/jpeg,image/png,application/json"
CACHE_EXTS = "html,mp3,mp4,ts,m4s,m3u8,vtt,webvtt,key,aac,jpg,png,json"
CACHE_HEADER = "X-Proxy-Cache"
JWT_AUTH_ENABLED = "false"            # Set to "true" to require JWT auth
JWT_ALGORITHM = "HS256"               # Change if using a different algorithm (e.g., "RS256")

3. Set the JWT secret (if using JWT auth)

Do not put JWT_SECRET in wrangler.toml! Instead, set it as a secret:

npx wrangler secret put JWT_SECRET

You will be prompted to enter the secret value.

4. Develop locally

npm start

5. Deploy to Cloudflare

npm run deploy

Usage

• To enable JWT authentication, set JWT_AUTH_ENABLED = "true" in the wrangler.toml and provide a valid JWT_SECRET (Do not put JWT_SECRET in wrangler.toml see step 3 in setup).
• Requests must include an Authorization: Bearer <token> header when JWT auth is enabled.
• Proxy requests must include a url query parameter with the base64-encoded target URL.
• Request headers can be set via the headers parameter as base64-encoded JSON.
• Optionally enable caching per-request via the cache parameter.