Refuse expired files with 410 instead of redirecting to the CDN#17

Merged

acoshift merged 7 commits into

mainfrom

claude/strange-mclean-0b1f86

May 24, 2026

Commits on May 24, 2026

Refuse expired files with 410 instead of redirecting to the CDN

acoshift
and
claude
committed
Check expired cache before Bucket.Attributes to absorb DDoS in-process

acoshift
and
claude
committed
Shield DDoS against non-existent fns with format validation + negative cache

acoshift
and
claude
committed
Singleflight the DB lookup so a thundering herd collapses to one query

acoshift
and
claude
committed
Sign download URLs, shorten filenames, drop random-token DDoS

acoshift
and
claude
committed
Separate fn and sig with "-" so fn length can change without breaking URLs

acoshift
and
claude
committed
Set Cache-Control on every /_cdn response

acoshift
and
claude
committed