External/OpenCut
1
0
Fork 0
mirror of https://github.com/OpenCut-app/OpenCut.git synced 2026-07-13 21:52:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

remove browser check

Browse Source
This commit is contained in:
Ahmet Kilinc
2025-07-16 01:23:06 +01:00
parent ece9c78b16
commit 79f6c680f3
1 changed files with 0 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/web/src/app/api/waitlist/route.ts
-109
View File
@@ -16,108 +16,6 @@ const waitlistSchema = z.object({
const CSRF_TOKEN_NAME = "waitlist-csrf"; const CSRF_TOKEN_NAME = "waitlist-csrf";
const TOKEN_EXPIRY = 60 * 60 * 1000; const TOKEN_EXPIRY = 60 * 60 * 1000;
function validateBrowserRequest(request: NextRequest): boolean {
const origin = request.headers.get("origin");
const referer = request.headers.get("referer");
const userAgent = request.headers.get("user-agent") || "";
const secFetchSite = request.headers.get("sec-fetch-site");
const secFetchMode = request.headers.get("sec-fetch-mode");
const secFetchDest = request.headers.get("sec-fetch-dest");
const contentType = request.headers.get("content-type");
const accept = request.headers.get("accept");
if (env.NODE_ENV === "development") {
console.log("=== Validating Browser Request ===");
console.log("Origin:", origin);
console.log("Referer:", referer);
console.log("User-Agent:", userAgent);
console.log("Sec-Fetch-Site:", secFetchSite);
console.log("Sec-Fetch-Mode:", secFetchMode);
console.log("Sec-Fetch-Dest:", secFetchDest);
console.log("Content-Type:", contentType);
console.log("Accept:", accept);
}
const allowedOrigins =
env.NODE_ENV === "development" ? ["http://localhost:3000", "http://127.0.0.1:3000"] : ["https://opencut.app", "https://www.opencut.app"];
if (!origin || !allowedOrigins.includes(origin)) {
console.log("Failed: Invalid origin");
return false;
}
if (!referer || !referer.startsWith(origin)) {
console.log("Failed: Invalid referer");
return false;
}
const suspiciousUserAgents = [
"curl",
"wget",
"postman",
"insomnia",
"thunder client",
"httpie",
"python-requests",
"node-fetch",
"axios",
"scrapy",
"httpclient",
"okhttp",
"libwww-perl",
"python-urllib",
"go-http-client",
"java/",
"apache-httpclient",
];
const lowerUserAgent = userAgent.toLowerCase();
if (!userAgent || suspiciousUserAgents.some((agent) => lowerUserAgent.includes(agent))) {
console.log("Failed: Suspicious user agent");
return false;
}
const hasBrowserIndicators =
lowerUserAgent.includes("mozilla/") ||
lowerUserAgent.includes("chrome/") ||
lowerUserAgent.includes("safari/") ||
lowerUserAgent.includes("firefox/") ||
lowerUserAgent.includes("edge/");
if (!hasBrowserIndicators) {
console.log("Failed: No browser indicators in user agent");
return false;
}
if (secFetchSite && secFetchSite !== "same-origin") {
console.log("Failed: Invalid Sec-Fetch-Site:", secFetchSite);
return false;
}
if (secFetchMode && secFetchMode !== "cors") {
console.log("Failed: Invalid Sec-Fetch-Mode:", secFetchMode);
return false;
}
if (secFetchDest && secFetchDest !== "empty") {
console.log("Failed: Invalid Sec-Fetch-Dest:", secFetchDest);
return false;
}
if (!contentType || !contentType.includes("application/json")) {
console.log("Failed: Invalid Content-Type");
return false;
}
if (!accept || (!accept.includes("application/json") && !accept.includes("*/*"))) {
console.log("Failed: Invalid Accept header");
return false;
}
console.log("Browser validation passed!");
return true;
}
async function validateCSRFToken(request: NextRequest): Promise<boolean> { async function validateCSRFToken(request: NextRequest): Promise<boolean> {
const clientToken = request.headers.get("x-csrf-token"); const clientToken = request.headers.get("x-csrf-token");
if (!clientToken) return false; if (!clientToken) return false;
@@ -153,13 +51,6 @@ export async function POST(request: NextRequest) {
if (!success) { if (!success) {
return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 }); return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });
} }
if (!validateBrowserRequest(request)) {
await new Promise((resolve) => setTimeout(resolve, Math.random() * 2000 + 1000));
return NextResponse.json({ error: "Invalid request" }, { status: 403 });
}
const isValidToken = await validateCSRFToken(request); const isValidToken = await validateCSRFToken(request);
if (!isValidToken) { if (!isValidToken) {
return NextResponse.json({ error: "Invalid security token" }, { status: 403 }); return NextResponse.json({ error: "Invalid security token" }, { status: 403 });