Fix img proxy: browser UA + Referer to bypass CDN hotlink blocks, only serve image content-type (404 for HTML)

index.ts

@@ -2085,13 +2085,22 @@ const server = Bun.serve({
         const cached = IMAGE_CACHE.get(key);
         if (cached) return new Response(cached.body, { headers: { "Content-Type": cached.type, "Cache-Control": "public, max-age=86400", "Access-Control-Allow-Origin": "*" } });
         const resp = await fetch(upstream.href, {
-          headers: { "User-Agent": "Mozilla/5.0 (compatible; VAI-Avatar2/1.0)" },
+          headers: {
+            "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120 Safari/537.36",
+            "Referer": upstream.origin + "/",
+            "Accept": "image/avif,image/webp,image/apng,image/*,*/*;q=0.8",
+          },
           signal: AbortSignal.timeout(15000),
+          redirect: "follow",
         });
         if (!resp.ok) return new Response("upstream " + resp.status, { status: 502 });
+        const type = (resp.headers.get("content-type") || "image/jpeg").split(";")[0].trim().toLowerCase();
+        // Only serve actual image content — a CDN that returns HTML (bot
+        // protection page, 404 page) must NOT be cached/served as an image.
+        // 404 lets the frontend onerror hide the broken <img> cleanly.
+        if (!/^image\//.test(type)) return new Response("not an image (" + type + ")", { status: 404 });
         const buf = Buffer.from(await resp.arrayBuffer());
         if (buf.length > 8 * 1024 * 1024) return new Response("too large", { status: 413 });
-        const type = resp.headers.get("content-type") || "image/jpeg";
         IMAGE_CACHE.set(key, { body: buf, type });
         if (IMAGE_CACHE.size > 300) { const first = IMAGE_CACHE.keys().next().value; if (first) IMAGE_CACHE.delete(first); }
         return new Response(buf, { headers: { "Content-Type": type, "Cache-Control": "public, max-age=86400", "Access-Control-Allow-Origin": "*" } });