Public media exemption: GET /reels/*.mp4 unauthenticated (console/APIs stay gated) — so Meta/TikTok can fetch reels

1584e5c11d2d7257aba48941d277a76cba5eb62a · 2026-07-12 11:56:01 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 1584e5c11d2d7257aba48941d277a76cba5eb62a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:56:01 2026 -0700

    Public media exemption: GET /reels/*.mp4 unauthenticated (console/APIs stay gated) — so Meta/TikTok can fetch reels
---
 server.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index e41ab2e..d6a1ab6 100644
--- a/server.js
+++ b/server.js
@@ -59,8 +59,14 @@ async function serveFile(fp, req, res) {
   createReadStream(fp).pipe(res);
 }
 
+// Finished reel MP4s are marketing assets meant to be posted publicly, and Meta/TikTok
+// must be able to fetch them — so GET /reels/*.mp4 is the ONE unauthenticated path.
+// Everything else (console, APIs, data) stays Basic-Auth gated.
+const PUBLIC_MEDIA = /^\/reels\/[^/]+\.mp4$/;
+const isPublicMedia = req => (req.method === 'GET' || req.method === 'HEAD') && PUBLIC_MEDIA.test(new URL(req.url, 'http://localhost').pathname);
+
 const server = http.createServer(async (req, res) => {
-  if (!authed(req)) {
+  if (!isPublicMedia(req) && !authed(req)) {
     res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="DW Marketing"' }).end('Auth required');
     return;
   }

← 20c8b48 Auto-post to IG/TikTok (fail-safe pending-creds) + captions · back to Dw Marketing Reels · Safety-when-on: ARMED gate (no live post until SOCIAL_LIVE_A 2f74ee0 →