updates

FlowPick v1.1.1: Protected Resource Preview & Download

v1.1.1 ships anti-hotlink proxy previews and downloads — images, audio, documents, and subtitles behind Referer checks now actually work. Faster video covers, stronger Firefox support.

FlowPick Team

August 14, 2026

7 min read

# release # v1.1.1 # update # changelog # anti-hotlink # firefox

v1.1.0 was about detecting more stuff. v1.1.1 is about downloading the stuff we already detected — specifically, the stuff that breaks when you try to grab it.

Here's the problem we kept hitting: FlowPick sniffs a media resource, shows it in the list, user clicks download, and… nothing. Or worse, an HTML error page saved as image.jpg. The cause? Anti-hotlink protection. The server checks the Referer header, sees a browser extension instead of the expected page, and returns a 403 or an HTML "please log in" page. FlowPick had the URL right but couldn't prove it belonged to an authorized request.

v1.1.1 fixes this with a proxy layer that carries the right headers. If you're running FlowPick, update from GitHub Releases. If you're new, the v1.0.0 release notes cover the basics.

Anti-hotlink proxy for previews

The first thing you'll notice: images that used to show broken placeholders now load.

Proxy-backed image previews. Image lists, cover art, hover previews, and full-size views now route through a proxy that carries Referer and cookies when available. Cross-origin restrictions that blocked direct requests are bypassed.
Cookies forwarded automatically. If the original page had a session cookie that authorized the image, the proxy carries it. No manual header configuration.

This was the #1 visual bug — FlowPick would detect 50 images on a gallery page, and half the thumbnails would be blank because the CDN refused cross-origin requests without a matching Referer. Now they load.

Unified proxy downloads

Previewing is one thing. Downloading is another — and v1.1.0 had a nasty bug where anti-hotlink-protected downloads would silently save an HTML error page as the requested file. You'd open cover.jpg and find a login form.

v1.1.1 adds unified proxy downloads for:

Images — JPG, PNG, GIF, WebP, SVG, AVIF
Audio — MP3, AAC, WAV, OGG, FLAC, M4A
Documents — PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, EPUB, CSV, RTF
Subtitles — SRT, VTT

The proxy carries Referer, cookies, and authentication headers. Before saving, the response is checked — if the server returned an HTML page (the "please log in" redirect), FlowPick rejects it instead of saving garbage. This is the fix for the "I downloaded an image but got an HTML file" reports.

Faster video cover loading

v1.0.0 and v1.1.0 had a dumb approach to video covers: try the direct cross-origin request first, wait for it to time out (could take 10+ seconds), then fall back to the proxy. v1.1.1 skips the timeout dance.

Direct proxy preload. Video covers with a Referer now go straight to the proxied resource. No more waiting for a cross-origin request to fail before switching.
Faster popup. The media list populates covers noticeably quicker, especially on image-heavy and video-heavy pages where 20+ covers load at once.

This is a small change with a big feel improvement. The popup feels snappier because you're not watching thumbnails trickle in over 15 seconds.

Stronger Firefox support

Firefox got the short end of the stick in v1.1.0 — Chrome's declarativeNetRequest API made header injection straightforward, but Firefox's implementation had gaps. v1.1.1 closes them.

webRequestBlocking for header injection. Firefox now uses webRequestBlocking to inject Referer and authentication headers on media requests. This is the API Chrome deprecated but Firefox still supports — and for this use case, it's the right tool.
Origin header stripped. Firefox's default Origin header was causing some servers to reject cross-origin media requests. v1.1.1 removes it automatically for media resources.
Reliable cross-origin loading. Protected images, audio, video, and other media now load consistently in Firefox. Previously, a chunk of Firefox users reported "FlowPick sees the resource but can't download it" — this was CORS + missing headers, now fixed.

Firefox users, this one's for you. The v1.0.0 release notes promised feature parity and we meant it — v1.1.1 makes that promise real for protected resources.

Bug fixes

The anti-hotlink rewrite also cleaned up a pile of edge cases:

Fixed images failing to display when blocked by anti-hotlink protection.
Fixed image downloads silently saving an HTML error page instead of the actual image.
Fixed audio and document downloads failing because required request headers were missing.
Fixed cross-origin CORS resources failing to load in Firefox.
Fixed some video covers loading too slowly.
Fixed proxy requests carrying cache headers that could cause incorrect or incomplete responses.

What's next

v1.1.1 is a reliability release — it makes the stuff FlowPick already detects actually downloadable. The next release will focus on format conversion (TS→MP4 works, but MKV/MP3 export is the most-requested feature) and performance on 4K streams.

If you hit a site where v1.1.1 still can't download a detected resource, file an issue with the URL and browser version. The changelog page tracks every release.

FlowPick v1.1.0: Smarter Media Detection — The previous release that improved detection; v1.1.1 makes those detected resources downloadable
FlowPick v1.0.0: First Public Release — The launch release this update builds on
How FlowPick Merges Hundreds of Video Segments in Your Browser — The WebAssembly FFmpeg pipeline that handles merging once resources are downloaded