Disable Direct Download
Direct Download lets the portal hand the device a URL to fetch firmware from. It is enabled by default, which means anyone who can open the portal can point your device at any address they like.
Behind authentication that is a convenience. Without it, on a network you do not fully control, it is a way to install firmware you did not write. If your product never needs it, turn it off.
Disable Direct Download
// Pass 'false' to refuse URLs handed over from the portal
ElegantOTA.setDirectDownloadMode(false);Enable Direct Download
// Pass 'true' to allow them again
ElegantOTA.setDirectDownloadMode(true);Direct Download is enabled by default on startup (cold boot).
Get Direct Download status
if (ElegantOTA.checkDirectDownloadMode() == true) {
Serial.println("Direct Download is enabled");
} else {
Serial.println("Direct Download is disabled");
}What changes
With Direct Download disabled:
- The Direct Download tab disappears from the portal.
- The endpoint refuses requests, whatever sends them.
ElegantOTA.pullFrom()returnsfalse- including when your own code calls it.
Uploading a .bin from the portal is unaffected, and so is the Auto, which only ever visits the URL you compiled in.
Turning this off is not a substitute for authentication. Someone who can reach an unprotected portal can still upload firmware by hand.
Compiling it out entirely
If you want neither Direct Download nor the Update Channel, you can leave the HTTP client out of the build altogether and get the flash back:
build_flags = -D ELEGANTOTA_ENABLE_REMOTE=0The portal then shows only the file upload, and the related functions are not compiled at all.