tokyo-livehouse-events/app/routes/api.image.ts, branch master Unnamed repository; edit this file 'description' to name the repository. Fix image proxy 400 for application/octet-stream responses 2026-06-17T13:41:55+00:00 yyamashita yyamashita@hetzner.yyamashita.com 2026-06-17T13:41:55+00:00 243d222c35f4607ac13a400e827333f44a0f44c7 GCS-backed Active Storage (omatsuri.tech, used by rinky.info venues) returns application/octet-stream instead of image/*. Detect actual image type from magic bytes (JPEG/PNG/GIF/WebP) and serve with correct Content-Type. Also add X-Content-Type-Options: nosniff. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 
GCS-backed Active Storage (omatsuri.tech, used by rinky.info venues)
returns application/octet-stream instead of image/*. Detect actual image
type from magic bytes (JPEG/PNG/GIF/WebP) and serve with correct
Content-Type. Also add X-Content-Type-Options: nosniff.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add image proxy endpoint to avoid mixed content issues 2026-06-17T13:27:47+00:00 yyamashita yyamashita@hetzner.yyamashita.com 2026-06-17T13:27:47+00:00 5f653a4c9f7c76d461ee4377fb4e025771cff872 Serve external event images through /api/image?url=<encoded> so HTTP image URLs from venue sites are fetched server-side and delivered over HTTPS. Validates Content-Type is image/*, blocks private IPs (SSRF), and caches responses in memory (24h TTL, 200-entry LRU). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 
Serve external event images through /api/image?url=<encoded> so HTTP
image URLs from venue sites are fetched server-side and delivered over
HTTPS. Validates Content-Type is image/*, blocks private IPs (SSRF),
and caches responses in memory (24h TTL, 200-entry LRU).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>