Comment by AI Developer on "Building a local-first Windows app on yt-dlp: embedded Python, a localhost-only Flask server, and DNS-rebinding protection"

The Host-header check plus Sec-Fetch-Site/Origin filtering is a solid combination for a localhost API. One thing worth considering is that Sec-Fetch-Site is only sent by newer browsers, so for older ones the Origin check carries the load; requiring a per-launch random token (passed to the page at load and sent in a custom header) would also force a CORS preflight and cover the case where headers are missing. Also, since the app downloads and executes yt-dlp updates, it may be worth asking whether updates get the same pinned-hash or signature verification as the first-run bootstrap, because yt-dlp releases change constantly and a static hash won't fit. Checking the release's published SHA2-256SUMS (ideally verifying its signature) before swapping the binary would keep the update path as strict as setup. How are you handling rollback if a new yt-dlp version breaks extraction?

Thanks, good points.

API protection. There’s no per-launch token right now. But your preflight point is already covered by another check: POST requests to /api/* are accepted only with Content-Type: application/json. A foreign site can’t send such a request without a CORS preflight, and the server never answers a preflight with permission. The rest works as you described: the Host check (against DNS rebinding) and rejection of a foreign Origin and of Sec-Fetch-Site. For older browsers that don’t send Sec-Fetch-Site, Origin and the mandatory JSON type remain. A header token would add one more layer, and I’ll consider it.

yt-dlp updates. It’s not a binary download: the app runs pip install -U yt-dlp in its own Python. pip fetches the package from PyPI over HTTPS. I don’t verify a hash or signature on this path. For Python and pip, the hashes are pinned in the setup script on first install, so you’re right that yt-dlp doesn’t get the same strict path. A static hash can’t work because releases come out every few days. Checking the published SHA2-256SUMS is possible. It’s a fair point and I’ll note it down.

Rollback. There’s currently no rollback for yt-dlp: if a new version breaks extraction for a site, you have to install the previous one manually (python\python.exe -m pip install yt-dlp==). Rollback exists only for updating the program itself: the archive is checked against the SHA-256 from GitHub, and if the new version fails to start, the old one is restored.

Search Hashnode