A global YouTube player LP is smart — just don’t let it get hijacked
One of my fave life-simplifying moves is using a global Asset Download LP, rather than infinite separate LPs that only differ by the asset URL. You pass the asset URL as a query param (URL-encoded, of course):
https://pages.example.com/getasset?asset=/whitepapers/my%20asset.pdf
Then JS on the page automatically updates a Download button’s target to get that resource.[1]
Similarly, a single Media Player LP can grab the video ID from the query string:
https://pages.example.com/player?videoId=ABC_123z
Then the corresponding video is embedded using, for example, the YouTube IFRAME embed.
But in both cases you must make sure that your labor-saving dynamic page can’t be used by malicious actors to serve their assets via your domain.
Securing an Asset Download LP
To lock down to just your assets, simply hard-code the origin so it always goes to your server:[2]
let thisURL = new URL(document.
