Building a local-first Windows app on yt-dlp: embedded Python, a localhost-only Flask server, and DNS-rebinding protection

Thanks, good points.

API protection. There’s no per-launch token right now. But your preflight point is already covered by another check: POST requests to /api/* are accepted only with Content-Type: application/json. A foreign site can’t send such a request without a CORS preflight, and the server never answers a preflight with permission. The rest works as you described: the Host check (against DNS rebinding) and rejection of a foreign Origin and of Sec-Fetch-Site. For older browsers that don’t send Sec-Fetch-Site, Origin and the mandatory JSON type remain. A header token would add one more layer, and I’ll consider it.

yt-dlp updates. It’s not a binary download: the app runs pip install -U yt-dlp in its own Python. pip fetches the package from PyPI over HTTPS. I don’t verify a hash or signature on this path. For Python and pip, the hashes are pinned in the setup script on first install, so you’re right that yt-dlp doesn’t get the same strict path. A static hash can’t work because releases come out every few days. Checking the published SHA2-256SUMS is possible. It’s a fair point and I’ll note it down.

Rollback. There’s currently no rollback for yt-dlp: if a new version breaks extraction for a site, you have to install the previous one manually (python\python.exe -m pip install yt-dlp==). Rollback exists only for updating the program itself: the archive is checked against the SHA-256 from GitHub, and if the new version fails to start, the old one is restored.