diff --git a/components/DownloadBtnGtoup.tsx b/components/DownloadBtnGtoup.tsx
index 3a354a0..b6b2f38 100644
--- a/components/DownloadBtnGtoup.tsx
+++ b/components/DownloadBtnGtoup.tsx
@@ -84,7 +84,7 @@ const DownloadButtonGroup: React.FC<{ downloadUrl: string }> = ({ downloadUrl })
           clipboard.copy(`${getBaseUrl()}/api?path=${asPath}&raw=true`)
           toast.success('Copied direct link to clipboard.')
         }}
-        btnColor="yellow"
+        btnColor="pink"
         btnText="Copy direct link"
         btnIcon="copy"
         btnTitle="Copy the permalink to the file to the clipboard"
diff --git a/config/api.json b/config/api.json
index 2594f63..4ff56b6 100644
--- a/config/api.json
+++ b/config/api.json
@@ -4,5 +4,6 @@
   "redirectUri": "http://localhost",
   "authApi": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
   "driveApi": "https://graph.microsoft.com/v1.0/me/drive",
-  "scope": "Files.Read.All Files.ReadWrite.All offline_access"
+  "scope": "Files.Read.All Files.ReadWrite.All offline_access",
+  "directLink": "https://public.dm.files.1drv.com"
 }
diff --git a/pages/api/proxy.ts b/pages/api/proxy.ts
index 1826a31..8327e33 100644
--- a/pages/api/proxy.ts
+++ b/pages/api/proxy.ts
@@ -1,19 +1,27 @@
 import axios from 'axios'
 import type { NextApiRequest, NextApiResponse } from 'next'
 
+import apiConfig from '../../config/api.json'
+
 export default async function handler(req: NextApiRequest, res: NextApiResponse) {
   // 'inline' is used for previewing PDF files inside the browser directly
   const { url, inline = false } = req.query
 
-  const decodedUrl = decodeURIComponent(url as string)
-  const { headers, data: stream } = await axios.get(decodedUrl, {
+  // Only handle urls that start with OneDrive's own direct link (or SharePoint's):
+  // https://public.dm.files.1drv.com/y4m0G_0GPeS8AXGrux-lVV79eU1F38VbWxtCSi-8-aUkBLeZH1H6...
+  if (!url || !(url as string).startsWith(apiConfig.directLink)) {
+    res.status(400).json({ error: 'Invalid URL' })
+    return
+  }
+
+  const { headers, data: stream } = await axios.get(url as string, {
     responseType: 'stream',
   })
 
   // Check if requested file is PDF based on content-type
   if (headers['content-type'] === 'application/pdf' && inline) {
     // Get filename from content-disposition header
-    const filename = headers['content-disposition'].split('filename*=')[1]
+    const filename = headers['content-disposition'].split(/filename[*]?=/)[1]
     // Remove original content-disposition header
     delete headers['content-disposition']
     // Add new inline content-disposition header along with filename