January 26th, 2024 Update

I have implemented some new features to help make using uploaded files a bit easier. Here's a list of features:

• Custom CDN link using my domain "cdn-slave.spin.rip" using PostgreSQL
• The custom CDN link provides permanent access to the attachment you uploaded
• Only the message ID and attachment ID are stored in the DB, nothing else
  • Unfortunately, this makes it a bit more difficult when other people try to self-host as they'll need to remove or setup PostgreSQL storage.
• Added a text field to let users fetch an attachment from a specific message ID
  • The message ID is provided on the /results page after an upload

Future plans

I do plan to make PostgreSQL easier to disable, right now it's tightly implemented in most of the routes. For now though, I don't have any future plans yet.

For now if you'd like a version of CDN Slave without PostgreSQL, you can check this out: https://github.com/spinfal/cdn-slave/tree/a8da067bacd612ee13dff6cad86bf57e0265b241

The damage

On September 29th, 2023 Discord announced some relatively big changes regarding their CDN and how links shared outside of Discord will work.

As seen in the image below, when you share an attachment CDN link outside of Discord there will be some additional URL parameters

What do these URL parameters do?

The use of these parameters was explained in the images provided, however, I'll explain this in this blog post as well.

As stated at the start of this post, new URL parameters for attachments have been added to improve the security of its CDN. The new parameters, ex, is, and hm, are designed to authenticate URLs, with links remaining valid until the specified expiration timestamp (ex). This change is currently not enforced but will be in the future, and Discord has begun implementing these parameters in CDN links. Below I've explained what each one is used for:

• ex: Indicates when the URL will expire.
• is: Timestamp of when the URL was issued.
• hm: A unique signature that remains valid until the expiration timestamp (ex).

The actual enforcement of these authenticated URLs will begin with a gradual rollout (stupid imo) starting no earlier than December 15.

What does this mean for CDN Slave?

This essentially means that any file uploaded to CDN Slave will be temporary, as you are accessing the CDN URLs outside of Discord. This also means you'll lose access to the file until I find a way to implement link refreshing.

So how can expired URLs be refreshed?

To renew an expired Discord CDN URL, developers just need to fetch the original message via Discord's API (a bot can obviously do this too, so I don't really need to directly request the API). The API will automatically provide an updated CDN URL in the message data.

However, this means CDN Slave will need to store message IDs and fetch them then serve them using CDN Slave's domain instead of Discord's. This isn't something I want to do but it's the only solution I can think of right now.

I will of course provide all available links on the upload page (CDN, media, and CDN-Slave).

CDN Slave update? wen eta.

I'm not really sure, I'd need to rework the backend of CDN Slave and figure out how to get the database working. I'm using Replit's Autoscale deployments feature and that method of hosting does not have persistent file storage, so a simple and local DB solution will not work.

I'll probably host the DB on my ras or just add a message ID URL parameter to the CDN Slave URL, we'll see. For now, all CDN links from CDN Slave will be temporary links, so please do NOT rely on CDN Slave for anything important.

If you have any questions or need any help, feel free to join my Discord server: https://out.spin.rip/discord

Or if you'd like to selfhost, you can check out my repo on GitHub: https://github.com/spinfal/cdn-slave