fix: bypass H5 geo-lock by forwarding the caller's real IP upstream - #16
Open
ndizeyedavid wants to merge 5 commits into
Open
fix: bypass H5 geo-lock by forwarding the caller's real IP upstream#16ndizeyedavid wants to merge 5 commits into
ndizeyedavid wants to merge 5 commits into
Conversation
Resolve the caller's real IP from proxy headers (X-Forwarded-For, X-Real-IP, socket peer) and forward it upstream via _geo_headers so AWS/CDN geo-locks see a residential client instead of the datacenter IP. Extend _make_request to merge those headers into every upstream call.
Wire the Request object into /home, /movies, /tv-series, /animation, /search, /search/suggest and /detail routes so every upstream call carries the caller's real IP via _geo_headers. This keeps the API usable from datacenter/VPS hosts behind AWS geo-locks.
The play request to the netfilm.world CDN is the one AWS actually geo-locks, so forward the caller's real IP there too (X-Forwarded-For/X-Real-IP) alongside the browser-fingerprint headers, and carry it through the domain + caption lookups as well.
The v2.2.0 aoneroom direct-stream server gets the same treatment: _client_ip/_geo_headers helpers, client-IP propagation through every route, and the real IP forwarded on the stream/caption play requests so the AWS geo-lock no longer blocks VPS deployments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the H5-block / AWS geo-locking problem (#4) that stops this API from working when deployed on VPS/datacenter hosts (Railway, Render, DigitalOcean, etc.). Cloudflare/
h5-api.aoneroom.comsees the datacenter's IP as non-residential and refuses responses.What changed
_client_ip()=> resolves the real caller IP from proacy headers (X-Forwarded-For=>X-Real-IP=> socket peer), with a null-safe fallback._geo_headers()=> maps that IP toX-Forwarded-For/X-Real-IPso the upstream CDN sees a residential client instead of the VPS._make_request()now merges those headers into every upstream call.main.py(the fileProcfile,railway.jsonandvercel.jsonactually run):/home,/movies,/tv-series,/animation,/search,/search/suggest,/detail,/api/stream/{id}and captions.api.py(the v2.2.0 direct-stream server), including theSTREAM_BASEplay requests onh5.aoneroom.com.requestis injected by FastAPI, all URL params keep their existing names/defaults, and existing clients are untouched.Why this works
The blocker is IP-based. The play/video requests carry a full browser fingerprint already; the missing piece was the source IP. Forwarding the caller's real IP makes the CDN believe the video request comes from the same residential client that loaded the site. so AWS stops geo-blocking requests coming from servers.
Testing
python -m py_compile main.py api.py=> passes. - Formatting follows PEP 8.python verify.pycurrently targets routes that the currentmain.pydoes not implement (/home/trending,/home/banner,/home/sections,/ranking) - this mismatch predates the PR, so the script cannot pass against the live server as-is. Happy to align if need tho...verify.pywith the actual route set in a follow-up PR if useful.Files touched
main.pyapi.py