56 lines
1.3 KiB
TypeScript
56 lines
1.3 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
|
|
function normalizeOrigin(origin: string) {
|
|
return origin.replace(/\/$/, "");
|
|
}
|
|
|
|
function getConfiguredOrigins() {
|
|
return (process.env.ATHENA_PUBLIC_ORIGIN ?? "")
|
|
.split(",")
|
|
.map((origin) => origin.trim())
|
|
.filter(Boolean)
|
|
.map(normalizeOrigin);
|
|
}
|
|
|
|
function getForwardedOrigin(request: NextRequest) {
|
|
const forwardedHost = request.headers.get("x-forwarded-host");
|
|
|
|
if (!forwardedHost) {
|
|
return null;
|
|
}
|
|
|
|
const forwardedProto = request.headers.get("x-forwarded-proto") ?? "https";
|
|
const firstHost = forwardedHost.split(",")[0]?.trim();
|
|
const firstProto = forwardedProto.split(",")[0]?.trim();
|
|
|
|
if (!firstHost || !firstProto) {
|
|
return null;
|
|
}
|
|
|
|
return `${firstProto}://${firstHost}`;
|
|
}
|
|
|
|
export function assertSameOrigin(request: NextRequest) {
|
|
const origin = request.headers.get("origin");
|
|
|
|
if (!origin) {
|
|
return null;
|
|
}
|
|
|
|
const requestOrigins = [
|
|
request.nextUrl.origin,
|
|
getForwardedOrigin(request),
|
|
...getConfiguredOrigins(),
|
|
]
|
|
.filter((value): value is string => Boolean(value))
|
|
.map(normalizeOrigin);
|
|
|
|
if (!requestOrigins.includes(normalizeOrigin(origin))) {
|
|
return NextResponse.json(
|
|
{ detail: "Ungültiger Ursprung der Anfrage" },
|
|
{ status: 403 },
|
|
);
|
|
}
|
|
|
|
return null;
|
|
}
|