Problem
Direct project-asset URLs encode the absence of transformation as ?format=raw. This affects images and every other supported asset format even though passthrough is simply the absence of a requested operation.
For Markdown images, an absolute project-app /cgi/image/<asset>?format=raw URL can also be requested while Markdown is displayed from another Builder origin. The transformer correctly rejects that cross-origin request with 403 Forbidden, leaving a broken asset.
Transformation selection must remain independent from access control: neither format=raw nor a source file format may authorize a cross-origin request.
Desired outcome
Generate root-relative, parameterless direct URLs for project assets of every supported format. The transformation endpoint passes a request through when no transformation parameters are present and performs a transformation only when the URL explicitly requests one. Authorization always runs first.
Scope and constraints
- Cover images, video, audio, fonts, documents, text files, archives, and other supported asset formats.
- Do not weaken same-origin/referrer protection.
- Do not treat
format=raw or any file format as an authorization exemption.
- Keep project asset references portable across Builder, preview, and published origins.
- Preserve explicit image transformations and legacy
format=raw URL compatibility.
- Preserve existing behavior for remote Markdown images.
Acceptance criteria
- Newly generated direct project-asset URLs do not contain
format=raw.
- Parameterless transformation-endpoint requests pass through regardless of the source format.
- Explicit transformation parameters continue to invoke supported transformations.
- Direct asset URLs resolve through the origin rendering the content.
- Untrusted cross-origin requests remain forbidden before the passthrough/transform decision.
- Regression coverage includes image and non-image formats, URL generation, and rendered Markdown.
Product questions
None currently.
Problem
Direct project-asset URLs encode the absence of transformation as
?format=raw. This affects images and every other supported asset format even though passthrough is simply the absence of a requested operation.For Markdown images, an absolute project-app
/cgi/image/<asset>?format=rawURL can also be requested while Markdown is displayed from another Builder origin. The transformer correctly rejects that cross-origin request with403 Forbidden, leaving a broken asset.Transformation selection must remain independent from access control: neither
format=rawnor a source file format may authorize a cross-origin request.Desired outcome
Generate root-relative, parameterless direct URLs for project assets of every supported format. The transformation endpoint passes a request through when no transformation parameters are present and performs a transformation only when the URL explicitly requests one. Authorization always runs first.
Scope and constraints
format=rawor any file format as an authorization exemption.format=rawURL compatibility.Acceptance criteria
format=raw.Product questions
None currently.