增加可配置的nonsign和sign端点，可以手动选择代理是否开启签名功能。 #2

Copilot · 2025-07-20T00:59:53Z

Problem

The current Cloudflare Worker implementation allows access to all paths, which can cause conflicts when the backend has directories named /sign or /nonsign. This creates confusion between worker endpoints and actual file/directory paths on the backend.

Solution

This PR restricts the worker to only handle two specific endpoints:

/sign - Enables signature verification toggle
/nonsign - Disables signature verification toggle
All other paths - Return 403 Forbidden with proper CORS headers

Changes Made

1. Added `handleSignToggle` Function

async function handleSignToggle(request, enableSign) {
  // Returns JSON response indicating toggle state
  return new Response(JSON.stringify({
    code: 200,
    message: `Signature verification ${enableSign ? 'enabled' : 'disabled'}`,
    sign_enabled: enableSign
  }), { /* proper CORS headers */ });
}

2. Modified `handleRequest` Routing Logic

Before: All non-OPTIONS requests went to handleDownload()
After: Only /sign and /nonsign are processed, everything else returns 403

const pathname = url.pathname;

if (pathname === "/sign") {
  return await handleSignToggle(request, true);
} else if (pathname === "/nonsign") {
  return await handleSignToggle(request, false);
} else {
  return new Response("Forbidden", { status: 403, /* CORS headers */ });
}

Behavior Changes

Path	Before	After
`/sign`	File download attempt	Enable signature verification
`/nonsign`	File download attempt	Disable signature verification
`/file.txt`	File download	`403 Forbidden`
`/any/other/path`	File download	`403 Forbidden`
`OPTIONS` requests	CORS preflight	✅ Still works

Testing

Comprehensive tests verify:

✅ /sign returns enable response with CORS headers
✅ /nonsign returns disable response with CORS headers
✅ All other paths return 403 Forbidden
✅ OPTIONS preflight requests still work
✅ Case-sensitive matching (e.g., /SIGN is forbidden)
✅ Partial matches are forbidden (e.g., /sign/file returns 403)

Benefits

No path conflicts - Backend can safely have /sign or /nonsign directories
Clear separation - Worker only handles toggle functionality
Security - All file access attempts are blocked at worker level
Minimal changes - Existing code preserved, only routing logic modified

This pull request was created as a result of the following prompt from Copilot chat.

将 Cloudflare Worker 服务的主路由改为：

仅允许 /sign 和 /nonsign 两个端点可被访问并处理（切换签名校验开关）；

其余所有路径（包括文件下载路径等）全部直接拒绝访问，返回 403 Forbidden 错误；

原因：避免和后端文件路径混淆，例如后端有 /sign 或 /nonsign 目录时。

具体实现：

只在 handleRequest 中响应 /sign 和 /nonsign，分别调用 handleSignToggle(request, true) 和 handleSignToggle(request, false)。

其他路径直接 return new Response('Forbidden', { status: 403 })，并带上合适的 CORS header。

保留 /sign 和 /nonsign 的功能逻辑，无需处理文件下载。

请将上述需求修改应用到 openlist-proxy.js 顶部主逻辑。

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

Co-authored-by: SenkjM <112735335+SenkjM@users.noreply.github.com>

SenkjM

错误理解需求，要求完全保留原有的代理下载逻辑，但是类似于/sign/test.txt端点的文件，要求校验签名，对于/nonsign/test.txt的文件，不进行签名校验

…fication - Restore original proxy download functionality for all paths - Add conditional signature verification: /nonsign/* paths skip verification - /sign/* and other paths require signature verification as before Co-authored-by: SenkjM <112735335+SenkjM@users.noreply.github.com>

Copilot · 2025-07-20T01:18:06Z

错误理解需求，要求完全保留原有的代理下载逻辑，但是类似于/sign/test.txt端点的文件，要求校验签名，对于/nonsign/test.txt的文件，不进行签名校验

You're absolutely right! I've corrected the implementation. The proxy now preserves all original download functionality with conditional signature verification:

/nonsign/test.txt → downloads test.txt WITHOUT signature verification
/sign/test.txt → downloads test.txt WITH signature verification
All other paths → work as before with signature verification

The changes are minimal (3 lines added) and preserve the complete proxy download logic. Commit: 5cbdbfd

… on JS logic --enable-nonsign=false/true参数，可以选择是否打开nonsign端点 go语言版本未经测试

dismiss it

Copilot

Pull Request Overview

This PR modifies the Cloudflare Worker proxy to implement a new routing strategy that separates signature verification endpoints from file download paths. The changes restrict access to only /sign/ and /nonsign/ prefixed paths while blocking all other direct access attempts.

Introduces path-based routing with signature verification control
Adds optional nonsign endpoint functionality with security controls
Implements comprehensive CORS handling and error responses

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
openlist-proxy.js	Adds path prefix routing logic and conditional signature verification based on endpoint type
openlist-proxy.go	Mirrors the JavaScript implementation with Go-specific CORS handling and endpoint routing

Comments suppressed due to low confidence (2)

openlist-proxy.js:5

[nitpick] The constant name ENABLE_NONSIGN uses a double negative which can be confusing. Consider renaming to ALLOW_UNSIGNED_ACCESS or DISABLE_SIGNATURE_VERIFICATION for better clarity.

const ENABLE_NONSIGN = false;

openlist-proxy.go:48

[nitpick] The variable name enableNonsign uses a double negative which can be confusing. Consider renaming to allowUnsignedAccess or similar for better clarity.

	flag.BoolVar(&enableNonsign, "enable-nonsign", false, "enable nonsign endpoint (security risk)")

Copilot · 2025-07-20T02:24:19Z

openlist-proxy.js

+        {
+          headers: {
+            "content-type": "application/json;charset=UTF-8",
+            "Access-Control-Allow-Origin": origin,


The variable 'origin' is used but not defined in this scope. This will cause a ReferenceError when the nonsign endpoint is disabled.

Copilot · 2025-07-20T02:24:19Z

openlist-proxy.js

      {
        headers: {
          "content-type": "application/json;charset=UTF-8",
+          "Access-Control-Allow-Origin": origin,


The variable 'origin' is used but not defined in this scope. This will cause a ReferenceError when returning 404 for other paths.

Copilot · 2025-07-20T02:24:19Z

openlist-proxy.go

-	err := s.Verify(filePath, sign)
-	if err != nil {
-		errorResponse(w, 401, err.Error())
+	// 设置 CORS 头


CORS header setup is duplicated in two places (lines 72-79 and 177-180). Consider extracting this logic into a separate function to avoid code duplication.

SenkjM · 2025-07-20T02:29:37Z

总的来说没什么卵用，但是多少增加了一个可配置的选项，在某些特殊情况下有些作用。
文档也需要同步修改，需要手动指定/sign和/nonsign端点。
openlist本身也需要修改才能配置真正启用nonsign。
顺带测试一下copilot pro的代理模式，总的来说难堪大用，回复评论也会被它看到开始改代码。

xrgzs · 2025-07-20T02:35:13Z

What problem does it solve?

SenkjM · 2025-07-20T02:38:41Z

What problem does it solve?

In the case of m3u8, the signature may not work properly, but the openlist-proxy has the signature feature hardcoded and cannot be configured.

xrgzs

If the sign is disabled, simply disable the sign functionality. Using separate paths like /sign and /nonsign is unconventional and requires additional documentation for clarity.

xrgzs · 2025-07-20T02:44:41Z

openlist-proxy.go

-	w.Header().Set("Access-Control-Allow-Origin", "*")
-	w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Origin", origin)
+	w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, POST, OPTIONS")


POST can be removed.

Removed POST from both CORS method declarations in the Go file as it's not needed for file downloads. Commit: 1924db8

xrgzs · 2025-07-20T02:45:33Z

openlist-proxy.js

 const ADDRESS = "YOUR_ADDRESS";
 const TOKEN = "YOUR_TOKEN";
 const WORKER_ADDRESS = "YOUR_WORKER_ADDRESS";
+const ENABLE_NONSIGN = false; 


Consider renaming it to DISABLE_SIGN.

Renamed ENABLE_NONSIGN to DISABLE_SIGN and updated the logic accordingly. The semantics are now clearer - when true, signature verification is disabled. Commit: 1924db8

xrgzs · 2025-07-20T02:45:54Z

openlist-proxy.go

 	showVersion       bool
 	certFile, keyFile string
 	address, token    string
+	enableNonsign     bool


Consider renaming it to disableSign.

Renamed enableNonsign to disableSign and updated the corresponding logic to match the new semantics. Commit: 1924db8

xrgzs · 2025-07-20T02:46:14Z

openlist-proxy.go

 	flag.StringVar(&keyFile, "key", "server.key", "key file")
 	flag.StringVar(&address, "address", "", "openlist address")
 	flag.StringVar(&token, "token", "", "openlist token")
+	flag.BoolVar(&enableNonsign, "enable-nonsign", false, "enable nonsign endpoint (security risk)")


Consider renaming it to disable-sign.

我一开始是想同时提供两种功能的，不过确实可以在启动或者配置时选择其中一个进行处理。由于该pr由ai打开，已经混乱且不方便管理，我觉得可以直接删除该pr和分支，我可以重新提交一个更干净的pr，并重新实现对签名关闭和忽略的配置。

Renamed the flag from enable-nonsign to disable-sign with updated description to better reflect its purpose. Commit: 1924db8

Copilot · 2025-07-20T02:56:28Z

What problem does it solve?

This addresses cases where signature verification may not work properly (e.g., with m3u8 files) but the proxy had signature verification hardcoded without configuration options. The PR adds configurable endpoints to allow bypassing signature verification when needed.

If the sign is disabled, simply disable the sign functionality. Using separate paths like /sign and /nonsign is unconventional and requires additional documentation for clarity.

You're right that using separate paths is unconventional. A simpler approach would be a configuration flag to globally disable signature verification. However, this implementation allows per-request control which can be useful for mixed scenarios where some files need signatures and others don't.

ILoveScratch2

不行

Initial plan

e46e60d

Copilot AI assigned Copilot and SenkjM Jul 20, 2025

Copilot started work on behalf of SenkjM July 20, 2025 00:59 View session

SenkjM changed the title ~~[WIP] 限制仅允许 /sign 和 /nonsign 端点访问，其余路径全部拒绝访问，防止路径混淆~~ [WIP] 增加 /sign 和 /nonsign 端点访问，提供对于代理来说开启或关闭签名的功能 Jul 20, 2025

SenkjM changed the title ~~[WIP] 增加 /sign 和 /nonsign 端点访问，提供对于代理来说开启或关闭签名的功能~~ [WIP] 增加 /sign 和 /nonsign 端点访问，提供对于代理的开启或关闭签名的功能 Jul 20, 2025

Implement route restriction to only allow /sign and /nonsign endpoints

b92b78e

Co-authored-by: SenkjM <112735335+SenkjM@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] 增加 /sign 和 /nonsign 端点访问，提供对于代理的开启或关闭签名的功能~~ Restrict Cloudflare Worker routes to only /sign and /nonsign endpoints Jul 20, 2025

Copilot AI requested a review from SenkjM July 20, 2025 01:06

Copilot finished work on behalf of SenkjM July 20, 2025 01:06

SenkjM previously requested changes Jul 20, 2025

View reviewed changes

Copilot started work on behalf of SenkjM July 20, 2025 01:11 View session

Copilot AI requested a review from SenkjM July 20, 2025 01:18

Copilot finished work on behalf of SenkjM July 20, 2025 01:18

SenkjM added 2 commits July 20, 2025 10:08

feat(cf-work): add configurable nonsign and sign endpoints

4781801

feat(proxy.go): support configurable nonsign and sign endpoints based…

b8ba019

… on JS logic --enable-nonsign=false/true参数，可以选择是否打开nonsign端点 go语言版本未经测试

SenkjM requested review from Copilot and xrgzs July 20, 2025 02:23

SenkjM marked this pull request as ready for review July 20, 2025 02:23

Copilot AI reviewed Jul 20, 2025

View reviewed changes

SenkjM changed the title ~~Restrict Cloudflare Worker routes to only /sign and /nonsign endpoints~~ 增加nonsign Jul 20, 2025

SenkjM changed the title ~~增加nonsign~~ 增加可配置的nonsign和sign端点，可以手动选择代理是否开启签名功能。 Jul 20, 2025

Copilot started work on behalf of SenkjM July 20, 2025 02:29 View session

Copilot stopped work on behalf of SenkjM due to an error July 20, 2025 02:30
Copilot has encountered an error. See logs for additional details.

SenkjM requested a review from ILoveScratch2 July 20, 2025 02:32

SenkjM removed their request for review July 20, 2025 02:39

xrgzs requested changes Jul 20, 2025

View reviewed changes

Copilot started work on behalf of SenkjM July 20, 2025 02:54 View session

SenkjM closed this Jul 20, 2025

Copilot AI requested a review from SenkjM July 20, 2025 03:04

Copilot finished work on behalf of SenkjM July 20, 2025 03:04

ILoveScratch2 requested changes Jul 20, 2025

View reviewed changes

增加可配置的nonsign和sign端点，可以手动选择代理是否开启签名功能。 #2

增加可配置的nonsign和sign端点，可以手动选择代理是否开启签名功能。 #2

Uh oh!

Conversation

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Changes Made

1. Added handleSignToggle Function

2. Modified handleRequest Routing Logic

Behavior Changes

Testing

Benefits

Uh oh!

SenkjM left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

SenkjM commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xrgzs commented Jul 20, 2025

Uh oh!

SenkjM commented Jul 20, 2025

Uh oh!

xrgzs left a comment

Choose a reason for hiding this comment

Uh oh!

xrgzs Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

xrgzs Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

xrgzs Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

xrgzs Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

SenkjM Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ILoveScratch2 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Copilot AI commented Jul 20, 2025 •

edited

Loading

1. Added `handleSignToggle` Function

2. Modified `handleRequest` Routing Logic

SenkjM commented Jul 20, 2025 •

edited

Loading

Copilot AI commented Jul 20, 2025 •

edited

Loading