File downloads can now come from a server-supplied host, but only for unauthenticated requests.
What's wrong with this entry?
The internal HTTP helper can take a base URL from the request itself, which the filestore staging path now uses to fetch from a server-supplied host.
- the override returns a request-supplied
baseUrlonly when the request is unauthenticated (auth: "none") and the host is not "frame" - the filestore credential response now carries a
filestoreUrl, passed asbaseUrlon readFile requests - a warning event is emitted when the server sends a URL that is rejected
stage_file_filestore_url_rejected
Strings lifted out of the shipped bundle, so the claim above can be checked against them.