Normalize and validate
Scheme, credentials, hostname, port, reserved networks, fragments, and tracking parameters are handled before a request leaves the Worker. Redirects are validated hop by hop.
From link to file, without invented steps.
Fetchora is a Cloudflare Worker application with server-rendered pages, a typed extraction layer, signed streaming, and an optional yt-dlp sidecar. Browser processing is separate by design.
Detect the provider
Exact host and path rules select a registry entry. Arbitrary lookalike subdomains are not trusted. Mastodon uses a limited path heuristic because its instances are decentralized.
Choose one resolver
Direct media gets a HEAD or one-byte Range probe. Known social providers use the configured extraction service. Public metadata is a fallback, not a substitute. Unknown pages only receive a generic Open Graph fallback.
Normalize real output
The server validates format structure, content types, media URLs, and sizes. It does not estimate missing qualities. Separate video and audio streams remain separate and labelled.
Sign delivery
Each verified media target is sealed in an AES-GCM token with a 20-minute lifetime. The stream endpoint rejects tampering, re-validates public destinations, and forwards range requests.
Process locally
FFmpeg.wasm is dynamically imported only when a toolkit job begins. The file is written to the WASM filesystem in the tab, processed, downloaded as a Blob, then deleted from memory.
Why yt-dlp is a separate service
Cloudflare Workers is not a Linux server. It does not ship Python, cannot spawn yt-dlp, and has strict CPU and subrequest limits. Rather than pretend otherwise, Fetchora defines an extraction interface and a companion service that runs yt-dlp where a general-purpose runtime is available. The Worker only calls it for providers that declare extractor support. A missing or unhealthy service becomes an explicit limitation.
What is stored
No media. Fetchora uses no R2 bucket, KV namespace, D1 database, or disk volume. Metadata and download tokens live in request memory. The rate limiter is per-isolate best effort, not a durable analytics store. The optional extraction service also proxies streams without persisting them, although its hosting provider may keep standard request logs.
Security boundaries
- Private IPv4/IPv6, loopback, metadata hosts, single-label hosts, and non-standard ports are blocked.
- Browser cookies and credentials are never forwarded to extraction targets.
- Downloads use authenticated encryption and a short expiry; there is no open URL proxy.
- Upstream HTML is rejected as media, and SVG is not offered as a download type.
Known limits
Social extraction can break whenever a platform changes. Cloudflare's free plan has platform-level limits that the app cannot override. Browser conversions are memory-bound. DNS rebinding is mitigated by blocking literal private destinations and relying on the platform's egress protections; it is not a formal security boundary for arbitrary network access. See the README for deployment and operational notes.