Wrong content type for avif images

Security
#1

hello,

for some reason Cloudflare sends a wrong content-type for avif images.
example is here: simple[dot]ponyclock[dot]com / test / test.webm.avif

it even tries to open it as a video in the browser.
i know it has “.webm” in it, but i think Cloudflare should only look at the last part and that is “.avif”.

so what i expect
content-type: image/avif

what i get
content-type: video/webm

i’m also not sure, does it also uses wrong cache expire times too?
i basically want it treated by Cloudflare completely like an browser image, not video.

#2
  1. That’s your server, not Cloudflare
    $ curl -I http://simple.ponyclock.com/test/test.webm.avif --connect-to ::[SERVER_IP] | grep Type
    Content-Type: video/webm
  1. Your issue is actually not the content type, but rather your insecure site
    $ curl -I https://simple.ponyclock.com/test/test.webm.avif --connect-to ::[SERVER_IP]
    curl: (35) error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error

You need to fix your server security, get a proper certificate, and fix the encryption mode on Cloudflare.

#3

my server is behind Cloudflare, its actually a managed one which is good secured. so i don’t actually understand what you showed me. the first command is a communication with the cf edge server i think, and not with my server behind Cloudflare. and i tested it with a url that is not protected by Cloudflare, which points directly to my server, and on that domain i get the correct content type. so i think this must be on cloudflares part.

#4

It’s clear that your server is behind Cloudflare, but that is not the point. Your server is neither secure nor well managed, simply because it has no SSL setup whatsoever.

As for the content type, as I already explained, that is sent by your server and Cloudflare does not set anything here, however that really is not issue. You have an insecure site and should fix this first.

#5

Best thing you can do, pause Cloudflare (Overview screen, bottom right) and make sure the URL loads fine on HTTPS and with the right content type.

#6

(post deleted by author)

#7

okay i checked it again, you are right, its probably a fault on my hoster. i will investigate this. this thread can be closed. thx for the great help.

#8