Static-hosting headers

Serve the release over HTTPS. Apply these headers to the app entry, wrapper worker, both core modes and every generated result page:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
X-Content-Type-Options: nosniff
Referrer-Policy: no-referrer
X-Frame-Options: DENY
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; font-src 'self'; style-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'

The multithread core requires all three cross-origin headers. Without them the app must select the single-thread core; the rest of the app still works. Never add broad 'unsafe-eval': WebAssembly needs only 'wasm-unsafe-eval'.

Response types:

*.wasm  Content-Type: application/wasm
*.js    Content-Type: text/javascript
*.mjs   Content-Type: text/javascript
*.json  Content-Type: application/json

All FFmpeg JS/WASM/worker files must be same-origin. A CDN requires careful cross-origin resource policy and is outside the supported deployment profile.

Use no-cache for index.html, toolbox-app.json, notices and other stable names. The files under the exact version directory vendor/ffmpeg/0.12.10-reviewed-stack5m.1/{st,mt}/ are content-verified and may use:

Cache-Control: public, max-age=31536000, immutable

Vite files whose names include their content hash under assets/ may use the same immutable policy. Do not make mutable or unversioned files immutable.

For a host with a _headers-style configuration, adapt:

/av/*
  Cross-Origin-Opener-Policy: same-origin
  Cross-Origin-Embedder-Policy: require-corp
  Cross-Origin-Resource-Policy: same-origin
  X-Content-Type-Options: nosniff
  Referrer-Policy: no-referrer
  X-Frame-Options: DENY
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
  Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; font-src 'self'; style-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'
  Cache-Control: no-cache

/av/vendor/ffmpeg/0.12.10-reviewed-stack5m.1/*
  Cache-Control: public, max-age=31536000, immutable

/av/assets/*
  Cache-Control: public, max-age=31536000, immutable

Confirm the provider can override .wasm to application/wasm; many _headers formats set headers but cannot correct MIME mappings. Validate a real response rather than relying only on configuration:

curl -sSI https://tools.example.test/av/ | sed -n '1,30p'
curl -sSI https://tools.example.test/av/vendor/ffmpeg/0.12.10-reviewed-stack5m.1/st/ffmpeg-core.wasm | sed -n '1,30p'

In browser developer tools, also verify window.crossOriginIsolated === true, that core URLs remain below the nested /av/ path, and that no runtime request targets a CDN.

3.2 KiB Raw Blame History

Static-hosting headers

3.2 KiB

Raw Blame History