From b7d62b3b1852a0721dafee843f7b342058bcb015 Mon Sep 17 00:00:00 2001
From: Kenneth Obsequio <k80308392@gmail.com>
Date: Tue, 14 Jul 2026 18:38:34 +0800
Subject: [PATCH] let middleware pass

This handles media controller communication.

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
---
 middleware/originGuard.middleware.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/middleware/originGuard.middleware.js b/middleware/originGuard.middleware.js
index c638185..beeca32 100644
--- a/middleware/originGuard.middleware.js
+++ b/middleware/originGuard.middleware.js
@@ -88,6 +88,11 @@ const VALID_FETCH_COMBOS = new Set([
   'cors|empty',         // standard fetch() from cross-origin SPA
   'same-origin|empty',  // same-origin fetch()
   'navigate|document',  // direct browser navigation to an API URL
+  'no-cors|image',      // <img src="..."> loading a media/asset route
+  'no-cors|video',      // <video src="..."> / <source> streaming a media route
+  'no-cors|audio',      // <audio src="...">
+  'no-cors|font',       // @font-face url() cross-origin font fetch
+  'no-cors|track',      // <track src="..."> (video subtitle/caption tracks)
 ]);
 
 module.exports = function originGuard(req, res, next) {